CVE-2026-9039 Initialization of a resource with an insecure default in XCharge C6
An attacker with physical access to the charging interface can use default credentials to gain full administrative control over the XCharge C6 device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9039?
CVE-2026-9039 is a high-severity vulnerability in XCharge C6, published on 28 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.
Weakness: CWE-1188
Which versions are affected by CVE-2026-9039?
How do I fix CVE-2026-9039?
No fix has been published for CVE-2026-9039 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9039 being exploited?
There is no known exploitation of CVE-2026-9039 in the wild and no public exploit code.
Sources
Also known as GHSA-9w95-xvpv-cvjw.