CVE-2026-9038: Stack-based buffer overflow in XCharge C6

Synopsis

A stack-based buffer overflow affects the XCharge C6 charging controller's signal-processing logic. An attacker with physical access to the charging interface can supply oversized message fields that corrupt memory, bypassing normal input validation. Successful exploitation enables execution of unauthorized code with elevated privileges, affecting confidentiality, integrity, and availability of both the local system and connected systems. A patched-image rebuild at version May_22_2026 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  Physical proximity to the charging interface is required; the attacker must have hands-on access to the device rather than reaching it over a network.

• AuthenticationNot required

  No credentials or account are needed; the attacker interacts directly with the physical charging interface without authenticating.

• Victim interactionNot required

  No user or victim action is needed beyond the attacker having physical access; exploitation does not require tricking anyone into performing a step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions such as race conditions or specific memory layout prerequisites.

Blast Radius

• Reads sensitive data from the local device and connected systems, including stored credentials, session state, and operational records.
• Modifies data and configuration on the local controller and any connected upstream systems, with high integrity impact on both.
• Crashes or disrupts the charging controller service and dependent connected systems, causing a full loss of availability.
• Executes arbitrary code with elevated privileges on the controller, giving an attacker persistent control over the device and its interfaces.