Phoenix Contact: Multiple vulnerabilities in the firmware of CHARX SEC3xxx charging controllers
Multiple vulnerabilities have been identified in the firmware of CHARX SEC-3xxx EV charging controllers, including the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models. The flaws could allow attackers to compromise the devices remotely, resulting in a complete loss of confidentiality, integrity, and availability.
describes (20)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-7849US | — | — | ||
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as r… | ||||
| CVE-2026-44108US | — | — | ||
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal se… | ||||
| CVE-2026-44107US | — | — | ||
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbus… | ||||
| CVE-2026-44106US | — | — | ||
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system com… | ||||
| CVE-2026-44105US | — | — | ||
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as t… | ||||
| CVE-2026-44104US | — | — | ||
The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This allows an unauthentic… | ||||
| CVE-2026-44103US | — | — | ||
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integr… | ||||
| CVE-2026-44102US | — | — | ||
An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible… | ||||
| CVE-2026-44101US | —OT elevated | — | ||
Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and c… | ||||
| CVE-2026-44100US | —OT elevated | — | ||
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files… | ||||
| CVE-2026-44099US | — | — | ||
A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise. | ||||
| CVE-2026-44098US | — | — | ||
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution o… | ||||
| CVE-2026-44097US | — | — | ||
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-… | ||||
| CVE-2026-44096US | — | — | ||
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise. | ||||
| CVE-2026-44095US | — | — | ||
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system c… | ||||
| CVE-2026-44094US | — | — | ||
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the at… | ||||
| CVE-2026-44093US | — | — | ||
A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full syst… | ||||
| CVE-2026-44092US | — | — | ||
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integr… | ||||
| CVE-2026-44091US | — | — | ||
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to int… | ||||
| CVE-2026-44090US | —OT elevated | — | ||
Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the devic… | ||||
references
External citations — patches, advisories, analysis.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2026-008: Phoenix Contact: Multiple vulnerabilities in the firmware of CHARX SEC3xxx charging controllers - HTMLself
- Phoenix Contact application noteexternal
- pcsa-2026-00006external
- VDE-2026-008: Phoenix Contact: Multiple vulnerabilities in the firmware of CHARX SEC3xxx charging controllers - CSAFself
remediations (20)
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
- Fixed
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.1 which fixes these vulnerabilities.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan