CVE-2026-9037

The record

A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.

Affected packages

Related vulnerabilities

• CVE-2026-102930 virtualenv is a tool for creating isolated virtual python environments. CWE-494
• CVE-2026-79963 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-494
• CVE-2026-62654 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). CWE-494
• CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection… CWE-494
• CVE-2026-84666 Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows… CWE-494
• CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote… CWE-494
• CVE-2026-82021 Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled… CWE-494
• CVE-2026-59286 The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a… CWE-494