Phoenix Contact Charx Sec-3000 vulnerabilities

CVE-2024-28137 [HIGH] CWE-367 CVE-2024-28137: A local attacker with low privileges A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability.

CVE-2024-28134 [HIGH] CWE-319 CVE-2024-28134: An unauthenticated remote attacker ca An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.

CVE-2024-28135 [MEDIUM] CWE-77 CVE-2024-28135: A low privileged remote attacker can use a command injection vulnerability in the API which performs A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.

CVE-2026-44103 [MEDIUM] CWE-434 CVE-2026-44103: An unauthenticated remote attacker can inject malicious firmware into the internal charging module b An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.

CVE-2026-44102 [MEDIUM] CWE-362 CVE-2026-44102: An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by su An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.

CVE-2024-25994 [MEDIUM] CWE-434 CVE-2024-25994: An unauthenticated remote attacker can upload a arbitrary script file due to improper input validati An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only.

CVE-2024-25997 [MEDIUM] CWE-20 CVE-2024-25997: An unauthenticated remote attacker can perform a log injection due to improper input validation. Onl An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected.

CVE-2024-3913 [MEDIUM] CWE-552 CVE-2024-3913: An unauthenticated remote attacker can use this vulnerability to change the device configuration due An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.

CVE-2026-44105 [MEDIUM] CWE-532 CVE-2026-44105: The credentials for the local user "user-app" may be exposed in log files, potentially enabling a lo The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.

CVE-2025-24002 [MEDIUM] CWE-20 CVE-2025-24002: An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations com An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.

CVE-2024-26005 [MEDIUM] CWE-459 CVE-2024-26005: An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup d An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS.

CVE-2025-24004 [MEDIUM] CWE-120 CVE-2025-24004: A physical attacker with access to the device display via USB-C can send a message to the device whi A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.