CVE-2026-9037Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08

Weakness type (CWE)

CWE-494

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-05-28); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Security Arsenal, LLC@SecurityAr58409136d
Disclosure
🔒 #CyberSecurity CVE-2026-9037: XCharge C6 Charging Controller Critical Firmware Vulnerability —… "XCharge C6 EV charging controllers vulnerable to CVE-2026-9037 (CVSS 9.8)…" 🔗 https://securityarsenal.com/blog/cve-2026-9037-xcharge-c6-charging-controller-critical-firmware-vulnerability-detection-and-remediation-guide #CyberSecurity #ThreatIntel #mdr #threathunting #endpointdetection
Post summary
The tweet announces a critical firmware vulnerability in XCharge C6 EV charging controllers (CVE-2026-9037 with CVSS 9.8) and points to a detection and remediation guide, but does not provide PoC, exploit, or active exploitation details.
0000071
16 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-9037 A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interf… https://www.cve.org/CVERecord?id=CVE-2026-9037
Post summary
The text references CVE-2026-9037, noting a flaw in a charging controller's firmware update mechanism that does not validate package authenticity, and links to the CVE record.
00000127
57.5K followersView on X

Explore more

Back to dashboard