Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers
VDE-2026-060: A unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers has been discovered.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-41032US | — | — | ||
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information. | ||||
references
External citations — patches, advisories, analysis.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2026-060: Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers - HTMLself
- Phoenix Contact application noteexternal
- PCSA-2026-00007external
- VDE-2026-060: Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers - CSAFself
remediations (2)
- Mitigation
Affected charging controllers are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.0 which fixes these vulnerabilities.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan