XCharge C6 chargers expose a remote‑management service on the vehicle‑charger signaling interface using a default administrative credential. The misconfiguration allows an authenticated session to be forged by any device that is physically connected to the charging port. Once authenticated, the attacker gains full administrative control over the charger, enabling configuration changes, firmware updates, or malicious service manipulation with the potential for arbitrary code execution or denial of service. This flaw is a classic case of a default credential weakness (CWE‑1188).

The vulnerability affects XCharge C6 electric vehicle chargers. No specific firmware versions are listed, indicating that all released models could be impacted until the vendor’s patch is applied.

The CVSS score of 8.6 classifies the issue as high severity, and although no EPSS score is available, the requirement of only a direct physical connection to the charging port greatly lowers the barrier to exploitation in environments where vehicle owners or attackers can attach a device. The vulnerability is not listed in the CISA KEV catalog, but its potential for full administrative takeover makes it a critical risk for facilities that rely on secure operations of their charging infrastructure.