# CVE-2026-9039: XCharge C6 insecure default credentials in remote management service

Source: https://junglewise.ai/threats/cve-2026-9039-xcharge-c6-insecure-default-credentials-in-remote-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-9039 · Severity: info · CVSS 7.6 · Published 2026-05-28

The XCharge C6 electric vehicle charging station contains a security flaw where its management interface is accessible through the physical charging cable. An attacker with physical access to the charger could use a malicious device to log in using default administrative credentials. This would allow the attacker to take full control of the charging station, potentially disrupting service or modifying device settings.

Technologies: [XCharge C6](https://junglewise.ai/threats/technologies/c6). Vendors: [XCharge](https://junglewise.ai/threats/vendors/xcharge).

## Quick answers

**Is CVE-2026-9039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9039 being exploited in the wild.

**How severe is CVE-2026-9039?** Informational severity, with a CVSS score of 7.6, published 28 May 2026.

**Which products and versions are affected?** XCharge C6 < May_22_2026.

**Is there a fix for CVE-2026-9039?** A patch was published on 2026-05-22: XCharge confirmed update deployment for all affected chargers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9039 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-9039?** Check whether you run XCharge C6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A configuration weakness (CWE-1188) in the XCharge C6 remote management service allows an authenticated session to be established over the Power Line Communication (PLC) or signaling channel intended for vehicle-to-charger communication. The service is improperly exposed on the physical charging interface and utilizes a default administrative credential. An attacker can connect a malicious device to the charging connector to access the management interface and gain full administrative rights. XCharge has reportedly deployed a firmware update to address this issue as of May 22, 2026.

## Affected products

- XCharge C6 < May_22_2026

## Timeline

- 2026-05-22: patched: XCharge confirmed update deployment for all affected chargers.
- 2026-05-28: advisory: CISA and NVD published advisory details.

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08](https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08)

## Related threats

- [XCharge C6 stack-based buffer overflow in charging controller](https://junglewise.ai/threats/cve-2026-9038-xcharge-c6-stack-based-buffer-overflow-in-charging-controller)
- [XCharge C6 firmware update integrity check bypass](https://junglewise.ai/threats/cve-2026-9037-xcharge-c6-firmware-update-integrity-check-bypass)