CVE-2026-9037
Download of code without integrity check in XCharge C6
- State
- Published
- Severity
- 9.3 Critical
- Published
- May 28, 2026
- Updated
- May 29, 2026
- Reserved
- May 19, 2026
Description
A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | icscert |
Weaknesses
- CWE-494 Download of code without integrity check
Affected Products
| Product | Versions |
|---|---|
C6XCharge |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.