CVE-2025-24002

CWE-20 — Improper Input Validation3 documents3 sources
Severity
5.3MEDIUM
EPSS
0.1%
top 66.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Phoenix Contact Charx Sec-3000Phoenix Contact Charx Sec-3050Phoenix Contact Charx Sec-3100+5 more
Timeline
PublishedJul 8

Description

An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages8 packages

▶CVEListV5phoenix_contact/charx_sec-30000.0.0 — 1.6.5
▶CVEListV5phoenix_contact/charx_sec-30500.0.0 — 1.6.5
▶CVEListV5phoenix_contact/charx_sec-31000.0.0 — 1.6.5
▶CVEListV5phoenix_contact/charx_sec-31500.0.0 — 1.6.5

🔴Vulnerability Details

2
CVEList
MQTT DoS Vulnerability in German EV Charging Stations↗2025-07-08
▶
GHSA
GHSA-r3v2-g9x9-gpj4: An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a↗2025-07-08
▶
CVE-2025-24002 (MEDIUM CVSS 5.3) | An unauthenticated remote attacker | cvebase.io