A stack-based buffer overflow exists in XCharge C6’s signal‑processing logic. When message fields are longer than expected, the controller’s input validation fails and corrupts the stack, potentially allowing execution of unauthorized code with elevated privileges. The consequence is loss of confidentiality, integrity, and availability of the charging system and any connected networks.

XCharge C6 charging controllers are affected. No specific firmware versions were disclosed, but the vendor states that all affected chargers have been updated.

The attack requires physical access to the charging interface to supply malformed messages. Although the EPSS metric is not available, the CVSS score of 8.6 indicates high severity. The vulnerability is not listed in the CISA KEV catalog, but the possibility of remote code execution makes the risk significant for environments where charging infrastructure is connected to critical networks.