CISA ICSA-26-148-08 Advisory: XCharge C6 Industrial Controller Vulnerabilities

Vulnerability Overview Vulnerability Name: XCharge C6 Publication Date: May 28, 2026 Alert Code: ICSA-26-148-08 Related Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Impact Scope Affected Version: C6 CVSS Score: v3.9.8 Vendor: XCharge Device: XCharge C6 Vulnerability Types: - Code download without integrity checks - Stack-based buffer overflow - Resource initialization with insecure defaults Remediation Recommended Practices: - Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - Use more secure communication methods, such as Virtual Private Networks (VPNs), when remote access is required, and ensure VPNs are updated to the latest version. - Perform appropriate impact analysis and risk assessment before deploying mitigations. - Implement recommended cybersecurity policies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and report to CISA. - Do not click links or open attachments in unsolicited emails. - Refer to CISA’s resources on avoiding email scams and social engineering attacks. Additional Information Background: - Critical Infrastructure Sector: Transportation Systems - Deployment Countries/Regions: Global - Company Headquarters Location: United States Acknowledgments: - These vulnerabilities were reported to CISA by Lionel R. Saposnik of SaiFlow. Revision History: - Initial Publication Date: May 28, 2026 - Revision: 1 - Summary: Initial release Tags Sector: Transportation Systems Sector Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Related Links Related Advisories: - Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter - ABB EIBPORT - Schneider Electric EcoStruxure Machine Expert HVAC - MacGregor Voyage Data Recorder (VDR) G4e Legal Notice and Terms of Use This product is subject to this notice and the Privacy and Use Policy. Feedback Please share your thoughts: We have recently updated our anonymous product survey and welcome your feedback. Contact CISA Central: - Phone: 1-844-Say-CISA - Email: contact@cisa.dhs.gov Official Website CISA.gov: - The official website of the U.S. Department of Homeland Security Other Links About CISA: - Budget and Performance - DHS.gov - FOIA Requests - No FEAR Act - Office of Inspector General - Privacy Policy - Subscribe - The White House - USA.gov - Website Feedback Social Media Facebook: [Link] X: [Link] LinkedIn: [Link] YouTube: [Link] RSS: [Link] Summary This page provides detailed information about multiple security vulnerabilities present in the XCharge C6 device, including a vulnerability overview, impact scope, remediation steps, and more. Users are advised to take appropriate defensive measures and refer to CISA-provided resources to enhance cybersecurity.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-148-08 Advisory: XCharge C6 Industrial Controller Vulnerabilities

More from this source