CVE-2026-9039: Xcharge c6

High severity, CVSS 8.6. EPSS: 0.2% chance of exploitation in the next 30 days.

A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.

Affected products

• Xcharge c6

Published 2026-05-28. Last modified 2026-06-17.