Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers
VDE-2026-060: A unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers has been discovered.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-41032US | — | — | ||
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2026-060: Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers - HTMLself
- Phoenix Contact application noteexternal
- PCSA-2026-00007external
- VDE-2026-060: Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers - CSAFself
Behebungen (2)
- Mitigation
Affected charging controllers are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.
- Behoben
Phoenix Contact strongly recommends to upgrade to firmware version 1.9.0 which fixes these vulnerabilities.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan