Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers
Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered.
beschreibt (5)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-24006US | — | — | ||
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root. | ||||
| CVE-2025-24005US | — | — | ||
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. | ||||
| CVE-2025-24004US | — | — | ||
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a te… | ||||
| CVE-2025-24003US | — | — | ||
An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrit… | ||||
| CVE-2025-24002US | — | — | ||
An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service f… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2025-014: Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers - HTMLself
- Phoenix Contact application noteexternal
- PCSA-2025-00001external
- VDE-2025-014: Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers - CSAFself
Behebungen (7)
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Mitigation
This product was designed for use in closed industrial networks. Phoenix Contact strongly recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our [application note](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).
- Behoben
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes vulnerabilities CVE-2025-24005 and CVE-2025-24006. The vulnerabilities CVE-2025-24002, CVE-2025-24003 and CVE-2025-24004 affect the Eichrecht functionality and in the meantime there is no vendor fix planned for these issues.
- Behoben
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes vulnerabilities CVE-2025-24005 and CVE-2025-24006. The vulnerabilities CVE-2025-24002, CVE-2025-24003 and CVE-2025-24004 affect the Eichrecht functionality and in the meantime there is no vendor fix planned for these issues..
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan