Read the docs
TI-2026-07946 Aliases CVE-2026-9039GHSA-9w95-xvpv-cvjw

Initialization of a resource with an insecure default in XCharge C6

Priority LOW 39CWE-1188Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00198 9th percentileScored 2026-11-07
Fix Fixed C6 (XCharge): May_22_2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XChargeC6before May_22_2026May_22_2026Patch availableCNA
  • C6 VendorXCharge Affected before May_22_2026 Fixed in May_22_2026 Patch available CNA

Remediation

  • Fix · CNA C6 (XCharge) Fixed in May_22_2026

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    XCharge C6 May_22_2026

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-07944 Download of code without integrity check in XCharge C6Priority MEDIUM 48
    • TI-2026-07945 Stack-based buffer overflow in XCharge C6Priority LOW 39
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9039
  2. 2026-10-03 Alias added: GHSA-9w95-xvpv-cvjw

References

Other 1

  • TI-2026-07944 Download of code without integrity check in XCharge C6 CVSS 4.0CRITICAL 9.3
  • TI-2026-07945 Stack-based buffer overflow in XCharge C6 CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences