XCharge C6

CISA published an advisory for multiple critical vulnerabilities in XCharge C6 electric vehicle charging controllers. The vulnerabilities include a firmware update mechanism that fails to validate authenticity (CVE-2026-9037, CVSS 9.8), a stack-based buffer overflow in signal processing (CVE-2026-9038, CVSS 7.6), and insecure default credentials in the remote management service (CVE-2026-9039, CVSS 7.6). Successful exploitation could allow attackers to gain administrator rights or execute code on affected devices. The vulnerabilities affect XCharge C6 chargers deployed worldwide in transportation systems critical infrastructure. XCharge has confirmed updates have been deployed for all affected chargers.