Critical Firmware Integrity Bypass in XCharge C6 (CVE‑2026‑9037) Threatens Transportation Systems
What It Is – A critical vulnerability (CVSS 3.9.8) in the firmware‑update mechanism of XCharge’s C6 charging controller allows unauthenticated firmware packages to be installed. The flaw stems from missing cryptographic signature verification, enabling an attacker to inject malicious code with administrator privileges.
Exploitability – The vulnerability is publicly disclosed (CVE‑2026‑9037) and can be exploited remotely by intercepting or spoofing the management channel. Proof‑of‑concept code has been shared in security forums, and active exploitation is considered likely given the high CVSS score.
Affected Products – XCharge C6 charging controllers (all firmware versions prior to the May 2026 update). The product is deployed worldwide in transportation‑system charging networks.
TPRM Impact –
- Compromise of charging infrastructure can cascade to fleet‑management systems, logistics platforms, and public EV‑charging services, creating a supply‑chain attack vector.
- Unauthorized code execution may disrupt vehicle charging, cause service outages, and expose operational data to adversaries.
Recommended Actions –
- Verify that the latest firmware (post‑May 2026) is installed on every XCharge C6 unit.
- Enforce network segmentation: isolate charger management interfaces from corporate LAN and restrict access to trusted IP ranges.
- Deploy integrity‑checking proxies or TLS‑termination gateways to validate firmware packages before they reach the device.
- Update internal asset inventories to flag XCharge C6 as high‑risk and include it in regular vulnerability‑scanning cycles.
- Coordinate with XCharge support for confirmation of patch deployment and obtain signed firmware hashes for future verification.
Source: CISA Advisory – ICSA‑26‑148‑08