CVE-2026-9037
Awaiting Analysis Awaiting Analysis - Queue

Firmware Signature Bypass in Charging Controller

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: ICS-CERT

Description
A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-07-08
AI Q&A
2026-05-28
EPSS Evaluated
2026-07-06
NVD
CVE-2026-9037
EUVD
EUVD-2026-33002

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the firmware update mechanism of a charging controller device. The mechanism does not validate the authenticity of firmware packages received through the device's management interface. Specifically, it fails to verify cryptographic signatures on the firmware packages.

As a result, an attacker who can interfere with or impersonate the management channel could cause the device to install unauthorized firmware. This unauthorized firmware could execute code with high privileges on the device.

Impact Analysis

The impact of this vulnerability is significant because it allows an attacker to execute unauthorized code with high privileges on the affected device. This could lead to complete compromise of the device, potentially allowing the attacker to control its functions, disrupt its operation, or use it as a foothold for further attacks within a network.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart