External risk intelligence

Charging Controller Firmware Update Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-9037

The vulnerability affects a firmware update mechanism in a charging controller. While the management interface is network-reachable, such devices are typically deployed within internal, segmented operational technology networks or behind private management controls rather than being directly exposed to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in a charging controller's firmware update process where the authenticity of updates is not verified. This could allow an attacker, if able to access the management channel, to install unauthorized code with high privileges on the device, potentially leading to a compromise of the controller's functionality.

Unverified firmware updates can lead to unauthorized code execution.
This highlights a potential risk to critical infrastructure controllers.
Confirm relevance and assess exposure to charging controller systems.

Attack Path

How an attacker could exploit the issue

An attacker could target a charging controller by interfering with its management interface to deliver a malicious firmware update. This is possible because the device does not verify the authenticity of the firmware packages it receives. If successful, the attacker could gain high-level control over the device.

No specific access is required.
An attacker can trigger the vulnerability by sending a fake firmware update.
Risk includes unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

An attacker could install unauthorized firmware on the charging controller, leading to code execution with high privileges on the device. This is possible when an attacker can interfere with or impersonate the management channel used for firmware updates, as the device fails to verify the authenticity of firmware packages.

High-privilege code execution on device.
Unauthorized firmware installation possible.
Compromised device functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

The teams most likely responsible for addressing this vulnerability are infrastructure or platform teams managing the charging controllers, alongside security operations for exposure assessment and network teams for ingress/egress control. The initial critical step is to identify all instances of the affected charging controllers, determine their network exposure and business criticality, and assign ownership before planning any remediation.

Infrastructure or platform teams own the issue.
Verify network exposure and asset criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the charging controller affected by CVE-2026-9037?

This device is a hardware controller typically used to manage and regulate electric charging processes for industrial or infrastructure-grade systems. It serves as the bridge between power supply management and the physical charging interface, ensuring that energy transfer is handled correctly. Its firmware governs these operations and includes a management interface designed for administrative updates.

What does CWE-494 mean for CVE-2026-9037?

CWE-494 refers to the download of code without integrity checks. In the context of CVE-2026-9037, this means the charging controller accepts and installs firmware packages without verifying their digital signatures or authenticity. Because the device trusts any incoming update file, an attacker can substitute legitimate software with malicious code, which the controller will then execute with full system privileges.

How is the firmware update vulnerability triggered?

The issue is triggered when an attacker manages to impersonate or interfere with the device's management channel to deliver a counterfeit firmware update. The vulnerability is not triggered by normal operational use or standard power delivery functions; it specifically requires the device to be tricked into processing a malicious update package. If a firmware update is not currently being initiated through the management channel, this specific path is not actively engaged.

Why should I care about CVE-2026-9037 if my device is internal?

While Halo Surface Signal notes that these controllers are often in segmented, private networks, the vulnerability remains a concern if an attacker gains access to that internal network. Even if a device is not directly on the public internet, anyone capable of reaching the management interface can attempt to push an unauthorized update. Assessing whether your management network is sufficiently isolated is a vital step in evaluating your true risk.

How do I start responding to this charging controller threat?

Begin by creating an inventory of all charging controllers in your environment to understand where they are deployed. Determine which devices are reachable via your internal networks and assess their business criticality. Once mapped, focus on securing the management channel to prevent unauthorized access. Coordination with your infrastructure or platform teams is essential to oversee these devices and plan for future maintenance or configuration updates.

References

www.cisa.gov/news-events/ics-advisories/icsa-26-148-08

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.