CVE-2025-25270
published 2025-07-08CVE-2025-25270: An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phoenix_contact | charx_sec-3000 | >= 0.0.0 < 1.7.3 | 1.7.3 |
| phoenix_contact | charx_sec-3050 | >= 0.0.0 < 1.7.3 | 1.7.3 |
| phoenix_contact | charx_sec-3100 | >= 0.0.0 < 1.7.3 | 1.7.3 |
| phoenix_contact | charx_sec-3150 | >= 0.0.0 < 1.7.3 | 1.7.3 |
| phoenixcontact | charx_sec-3000_firmware | < 1.7.3 | 1.7.3 |
| phoenixcontact | charx_sec-3050_firmware | < 1.7.3 | 1.7.3 |
| phoenixcontact | charx_sec-3100_firmware | < 1.7.3 | 1.7.3 |
| phoenixcontact | charx_sec-3150_firmware | < 1.7.3 | 1.7.3 |