Phoenix Contact Charx Sec-3000 vulnerabilities

CVE-2025-25270 [CRITICAL] CWE-913 CVE-2025-25270: An unauthenticated remote attacker can alter the device configuration in a way to get remote code ex An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.

CVE-2026-44090 [CRITICAL] CWE-306 CVE-2026-44090: Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.

CVE-2026-44098 [HIGH] CWE-78 CVE-2026-44098: This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

CVE-2026-44108 [CRITICAL] CWE-696 CVE-2026-44108: Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematur Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.

CVE-2026-7849 [CRITICAL] CWE-77 CVE-2026-7849: Due to improper neutralization of special elements, an unauthenticated remote attacker is able to in Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.

CVE-2026-44104 [CRITICAL] CWE-347 CVE-2026-44104: The firmware update process for the basemodule of the charging controller only validates the CRC32 c The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

CVE-2024-25995 [CRITICAL] CWE-20 CVE-2024-25995: An unauthenticated remote attacker can modify configurations to perform a remote code execution, gai An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation.

CVE-2026-44101 [CRITICAL] CWE-306 CVE-2026-44101: Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.

CVE-2024-6788 [CRITICAL] CWE-1392 CVE-2024-6788: A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the de A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.

CVE-2024-25996 [CRITICAL] CWE-346 CVE-2024-25996: An unauthenticated remote attacker can perform a remote code execution due to an origin validation e An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user.

CVE-2025-41699 [HIGH] CWE-94 CVE-2025-41699: An low privileged remote attacker with an account for the Web-based management can change the system An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code ('Code Injection').

CVE-2026-44094 [HIGH] CWE-636 CVE-2026-44094: An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.

CVE-2026-44092 [CRITICAL] CWE-93 CVE-2026-44092: An unauthenticated remote attacker can inject malicious input into the ModbusServer application beca An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

CVE-2026-44091 [CRITICAL] CWE-501 CVE-2026-44091: An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creatio An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.

CVE-2026-44100 [CRITICAL] CWE-306 CVE-2026-44100: The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.

CVE-2025-25268 [HIGH] CWE-306 CVE-2025-25268: An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.

CVE-2024-26001 [CRITICAL] CWE-787 CVE-2024-26001: An unauthenticated remote attacker can write memory out of bounds due to improper input validation i An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.

CVE-2024-11497 [HIGH] CWE-732 CVE-2024-11497: An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.

CVE-2025-25271 [HIGH] CWE-1188 CVE-2025-25271: An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaul An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.

CVE-2024-26288 [HIGH] CWE-319 CVE-2024-26288: An unauthenticated remote attacker can influence the communication due to the lack of encryption of An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected.