CVE-2025-25271
published 2025-07-08CVE-2025-25271: An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.
high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phoenix_contact | charx_sec-3000 | >= 0.0.0 < 1.7.3 | 1.7.3 |
| phoenix_contact | charx_sec-3050 | >= 0.0.0 < 1.7.3 | 1.7.3 |
| phoenix_contact | charx_sec-3100 | >= 0.0.0 < 1.7.3 | 1.7.3 |
| phoenix_contact | charx_sec-3150 | >= 0.0.0 < 1.7.3 | 1.7.3 |
| phoenixcontact | charx_sec-3000_firmware | < 1.7.3 | 1.7.3 |
| phoenixcontact | charx_sec-3050_firmware | < 1.7.3 | 1.7.3 |
| phoenixcontact | charx_sec-3100_firmware | < 1.7.3 | 1.7.3 |
| phoenixcontact | charx_sec-3150_firmware | < 1.7.3 | 1.7.3 |