CVE-2026-44104
published 2026-07-30CVE-2026-44104: The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.27%
19.0th percentile
The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phoenix_contact | charx_sec-3000 | >= 1.0.0 < 1.9.1 | 1.9.1 |
| phoenix_contact | charx_sec-3050 | >= 1.0.0 < 1.9.1 | 1.9.1 |
| phoenix_contact | charx_sec-3100 | >= 1.0.0 < 1.9.1 | 1.9.1 |
| phoenix_contact | charx_sec-3150 | >= 1.0.0 < 1.9.1 | 1.9.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification.
ghsa_unreviewed·2026-07-30
CVE-2026-44104 [CRITICAL] CWE-347 The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification.
The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
GHSA
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification
ghsa_unreviewed·2026-07-30·CVSS 9.8
CVE-2026-44103 [CRITICAL] CWE-434 An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-30
Published