XCharge

A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface.

A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling.

A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds.