# CVE-2026-9039: XCharge C6 firmware update integrity check bypass

Source: https://junglewise.ai/threats/cve-2026-9037-xcharge-c6-firmware-update-integrity-check-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-9039 · Severity: high · CVSS 9.8 · Published 2026-05-28

The XCharge C6 electric vehicle charging controller contains a flaw in how it handles software updates. An attacker can trick the device into installing malicious software because the system does not verify if the update is authentic. This could allow a remote attacker to take full control of the charging station, potentially leading to service disruptions or unauthorized access to the device's functions.

Technologies: [XCharge C6](https://junglewise.ai/threats/technologies/c6). Vendors: [XCharge](https://junglewise.ai/threats/vendors/xcharge).

## Quick answers

**Is CVE-2026-9039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9039 being exploited in the wild.

**How severe is CVE-2026-9039?** High severity, with a CVSS score of 9.8, published 28 May 2026.

**Which products and versions are affected?** XCharge C6 < May_22_2026, Versions prior to May 22, 2026.

**Is there a fix for CVE-2026-9039?** A patch was published on 2026-05-22: XCharge confirmed updates were deployed to affected chargers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9039 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-9039?** Check whether you run XCharge C6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as a 'Download of Code Without Integrity Check' (CWE-494) within the firmware update mechanism of the XCharge C6 charging controller. The device's management interface does not verify cryptographic signatures of incoming firmware packages. An attacker capable of intercepting or impersonating the management channel can deliver a malicious firmware image. Successful exploitation results in the execution of unauthorized code with administrative privileges. XCharge has reportedly deployed an update to all affected chargers as of May 22, 2026.

## Affected products

- XCharge C6 < May_22_2026

## Identifiers

- CVE-2026-9039
- CVE-2026-9037
- CVE-2026-9038

## Timeline

- 2026-05-22: patched: XCharge confirmed updates were deployed to affected chargers.
- 2026-05-28: disclosed: Initial publication of ICS Advisory ICSA-26-148-08.

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08](https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08)

## Related threats

- [XCharge C6 insecure default credentials in remote management service](https://junglewise.ai/threats/cve-2026-9039-xcharge-c6-insecure-default-credentials-in-remote-management)
- [XCharge C6 stack-based buffer overflow in charging controller](https://junglewise.ai/threats/cve-2026-9038-xcharge-c6-stack-based-buffer-overflow-in-charging-controller)