VULNERABILITY INTELLIGENCE
CVE-2026-9039
EPSS probability0.20%
CISA KEVNot currently listed
Published2026-05-28
Last modified2026-10-26
Description
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.
Weakness classification
- ics-cert@hq.dhs.gov: CWE-1188