CVE-2026-9038

Vulnerability

A stack-based buffer overflow exists in the signal-processing logic of XCharge C6 charging controllers (versions prior to May 22, 2026). The vulnerability occurs when the device processes message fields received through the charging interface without proper bounds checking. An attacker who supplies fields that exceed expected buffer sizes can trigger memory corruption, potentially leading to unauthorized code execution [1].

Exploitation

Exploitation requires physical access to the charging interface of the affected XCharge C6 device. The attacker must send specially crafted messages with oversized fields to the controller's signal-processing component. This triggers a stack-based buffer overflow, corrupting adjacent memory. No authentication is needed, and the attacker only needs a physical connection to the charging port [1].

Impact

Successful exploitation allows an attacker to execute unauthorized code with elevated privileges, potentially gaining full administrative rights over the charging controller. This could enable further compromise of the device and the broader charging infrastructure [1].

Mitigation

XCharge has released a firmware update dated May 22, 2026, that addresses this vulnerability. Users should update their XCharge C6 devices to the latest firmware version. No workarounds are provided in the available references [1].