PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9038 XCharge CVE debrief

A stack-based buffer overflow vulnerability exists in a charging controller's signal-processing logic. The vulnerability stems from insufficient input validation on message fields supplied through the physical charging interface. An attacker with physical access can supply input that exceeds expected bounds, causing memory corruption that may lead to unauthorized code execution with elevated privileges. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and carries a HIGH severity CVSS score of 8.6. The CISA ICS-CERT has published advisory ICSA-26-148-08 addressing this issue. Physical access requirements limit remote exploitation, but the impact is severe given potential for complete system compromise.

Vendor
XCharge
Product
C6
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Operators of electric vehicle charging infrastructure, industrial control system security teams, charging equipment manufacturers, and facilities with exposed charging interfaces should prioritize this vulnerability given the potential for complete system compromise through physical access.

Technical summary

The vulnerability resides in signal-processing logic within a charging controller implementation. Message field parsing lacks adequate bounds checking, permitting stack memory corruption when oversized input is supplied through the physical charging interface. Successful exploitation yields code execution with elevated privileges, potentially compromising the entire charging system. The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects that while physical access is required, the attack complexity is low and impacts are comprehensive across all security properties.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict physical access to charging interfaces to authorized personnel only
  • Monitor for anomalous charging controller behavior or unexpected restarts
  • Apply vendor firmware updates when available per CISA ICS-CERT guidance
  • Implement input validation and bounds checking in charging controller firmware where source code access exists
  • Segment charging infrastructure networks to limit lateral movement if compromise occurs

Evidence notes

Vulnerability disclosed via NVD with CISA ICS-CERT advisory reference. CVSS 4.0 vector indicates physical attack vector (AV:P) with high impacts across confidentiality, integrity, and availability. Vendor identification marked as unknown and flagged for review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9038 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9038

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9038 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9038

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.