Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers
Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24006US | — | — | ||
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root. | ||||
| CVE-2025-24005US | — | — | ||
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. | ||||
| CVE-2025-24004US | — | — | ||
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a te… | ||||
| CVE-2025-24003US | — | — | ||
An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrit… | ||||
| CVE-2025-24002US | — | — | ||
An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service f… | ||||
references
External citations — patches, advisories, analysis.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2025-014: Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers - HTMLself
- Phoenix Contact application noteexternal
- PCSA-2025-00001external
- VDE-2025-014: Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers - CSAFself
remediations (7)
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes vulnerabilities CVE-2025-24005 and CVE-2025-24006. The vulnerabilities CVE-2025-24002, CVE-2025-24003 and CVE-2025-24004 affect the Eichrecht functionality and in the meantime there is no vendor fix planned for these issues.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes vulnerabilities CVE-2025-24005 and CVE-2025-24006. The vulnerabilities CVE-2025-24002, CVE-2025-24003 and CVE-2025-24004 affect the Eichrecht functionality and in the meantime there is no vendor fix planned for these issues..
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan