The vulnerability arises from a firmware update mechanism in XCharge C6 charging controllers that does not verify the authenticity of firmware packages delivered through the device's management interface. Cryptographic signatures are omitted, allowing an actor who can intercept or impersonate the management channel to install an unauthorized firmware package. The result is the ability to execute code with high privileges on the device, compromising its operation and potentially posing a danger to connected vehicles or infrastructure.

All XCharge C6 charging controller firmware is impacted. No specific firmware version numbers are provided, so the existing VPN and management support for all C6 models requires remediation.

The CVSS score of 9.3 classifies this flaw as critical, and the attacker needs only a foothold in the management channel to exploit it. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, the public exploitation probability is unclear, but the high severity indicates that the potential impact drives a high-priority response. The most likely attack vector is remote or local access to the management interface; an attacker could use it as a foothold for further malicious activity if the device is networked.