What’s Vulnerable › Vulnerabilities
CVE-2026-9037: Download of code without integrity check in XCharge C6
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-28 · updated 2026-10-26
- Weakness: CWE-494
Description
A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.
Affected products
- XCharge C6: before May_22_2026 — fixed in May_22_2026
How to fix
Upgrade to a fixed version: XCharge C6 May_22_2026. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-9037 or the next vulnerability affects your stack