CVE-2026-9039 — Initialization of a resource with an insecure default in XCharge C6
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-cha…
Published: 2026-05-28 · CVSS: 8.6 · CVSS 4.0
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7