VDE-2025-019

csafDEphoenix_contact_psirt

Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

Advisory ansehen veröffentlicht 2025-07-08

Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered. **Update Version 1.1.0:** Updated the reporting credits for CVE-2025-25271.

01

beschreibt (4)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-25271US	—OT erhöht	0.35% (28th)	—	2025-07-08
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.
CVE-2025-25270US	—	0.75% (55th)	—	2025-07-08
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
CVE-2025-25269US	—	0.30% (22nd)	—	2025-07-08
An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.
CVE-2025-25268US	—OT erhöht	0.36% (30th)	—	2025-07-08
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.

02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (4)

Behoben
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes these vulnerabilities.
Behoben
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes these vulnerabilities.
Behoben
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes these vulnerabilities.
Behoben
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes these vulnerabilities.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan