CVE-2026-9037: Download of code without integrity check in XCharge C6

Synopsis

This is an unauthenticated remote code execution vulnerability caused by a missing integrity check in the firmware update mechanism of the XCharge C6 charging controller. An attacker who can intercept or impersonate the device's management channel over the network, without any credentials, can deliver a tampered firmware package that the device installs without signature verification. Successful exploitation gives the attacker full code execution with high privileges on the device. A patched-image rebuild at version May_22_2026 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the device's management interface over the network in order to intercept or impersonate the firmware update channel.

• AuthenticationNot required

  No credentials are needed; the firmware update mechanism accepts packages without authenticating the source.

• Victim interactionNot required

  No user or operator action is required after the attacker delivers the malicious firmware package.

• Attack complexityDetail

  The exploit is reliable and condition-free once network access to the management channel is established; no race conditions or special environmental factors apply.

Blast Radius

• The attacker executes arbitrary code at high privilege on the XCharge C6 device, gaining full control of its runtime environment.
• All data stored on or processed by the device, including configuration and session state, is readable by the attacker.
• The attacker can modify persisted firmware, configuration, or charging-session records on the device.
• The attacker can crash or permanently alter the charging controller, causing a service outage for connected charging sessions.