CVE-2026-9039: Initialization of a resource with an insecure default in XCharge C6

Synopsis

An insecure default credential vulnerability in the XCharge C6 EV charger allows an attacker who physically connects a malicious device to the charging interface to authenticate to the remote management service using the factory default administrative credential. The service is reachable over the charging connector's communication channel rather than a standard network interface, requiring physical access to the hardware. Successful exploitation gives the attacker full administrative control over the device, including reads and writes to all configuration and operational data. A patched-image rebuild at version May_22_2026 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker requires physical proximity to the device; exploitation is carried out by connecting a malicious device directly to the charging connector interface, not over a remote network.

• AuthenticationNot required

  No credential discovery is needed; the service accepts a publicly known factory default administrative credential, so no prior account access is required.

• Victim interactionNot required

  No action from an operator or user of the charger is needed; the attacker completes the attack entirely through the physical hardware interface.

• Attack complexityDetail

  Exploit conditions are reliable and free of environmental dependencies; no race conditions or special memory layout requirements are involved.

Blast Radius

• Attacker reads all stored device configuration, operational parameters, and any credentials or session data held by the management service.
• Attacker writes arbitrary configuration changes, including modifying charging behavior, disabling safety interlocks, or altering communication endpoints.
• Attacker disrupts availability of the charging service, causing the unit to stop accepting or completing charge sessions.
• The system impact scores are also High across confidentiality, integrity, and availability, meaning downstream systems that trust data or commands from the C6 are equally exposed to manipulation or denial.