Description Summary:
An improper command neutralization vulnerability allows an unauthenticated remote attacker to execute arbitrary commands as root on the system.

Executive Summary:
A critical command injection vulnerability in Phoenix Contact charging controllers allows unauthenticated attackers to execute arbitrary code with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-7849

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is a command injection (CWE-77) flaw where input is not properly sanitized before being passed to a system command. An unauthenticated attacker can inject malicious commands, which the system then executes with root permissions.

Business Impact

The CVSS score of 9.8 underscores the extreme severity of this flaw. Full root access grants an attacker the ability to manipulate charging parameters, install persistent malware, or disable safety mechanisms, which could have catastrophic impacts on both physical equipment and operational safety.

Remediation Plan

Immediate Action: Update the affected Phoenix Contact CHARX controller firmware to version 1.9.1 or later to implement proper input sanitization.

Proactive Monitoring: Audit system logs for anomalous command execution patterns or unexpected changes to system configuration files.

Compensating Controls: Implement strict network ingress filtering to ensure that only authorized traffic can reach the configuration interfaces of the charging controllers.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection remains one of the most dangerous vulnerability classes due to the ease of achieving arbitrary code execution.

Analyst Recommendation

Command injection vulnerabilities are high-priority targets for attackers. It is imperative that all affected CHARX controllers are updated to version 1.9.1 immediately to close this vector and prevent unauthorized root access to the underlying operating system.

Description Summary:
A script execution order flaw during system shutdown causes the firewall to terminate prematurely, exposing internal services to unauthenticated remote attackers.

Executive Summary:
A critical race condition in Phoenix Contact charging controllers exposes internal services to remote attackers during the system shutdown process.

Vulnerability Details

CVE-ID: CVE-2026-44108

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is an incorrect behavior order (CWE-696) vulnerability. The firewall is shut down before other services, creating a temporary, exploitable window where internal network services are reachable by unauthenticated remote actors.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a high risk of unauthorized access to sensitive internal services. An attacker could leverage this window to gain a foothold in the controller, potentially leading to full system compromise or lateral movement within the operational network.

Remediation Plan

Immediate Action: Update the affected Phoenix Contact CHARX controller firmware to version 1.9.1 or later to correct the service shutdown sequence.

Proactive Monitoring: Monitor network traffic for unusual connection attempts during periods of system maintenance or expected reboots.

Compensating Controls: Isolate the controllers within a restricted VLAN and utilize firewall rules to block unsolicited incoming traffic, even if the device internal firewall is temporarily disabled.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Exploitation requires precise timing, but the potential for remote compromise remains high.

Analyst Recommendation

The vulnerability highlights a critical flaw in the system shutdown sequence that exposes internal services. Organizations must apply the vendor-provided firmware update to version 1.9.1 as soon as possible to ensure the firewall remains active until all services are safely terminated.

Description Summary:
The firmware update process for Phoenix Contact charging controllers lacks cryptographic signature verification, allowing unauthenticated remote attackers to install malicious firmware.

Executive Summary:
A critical vulnerability in Phoenix Contact charging controllers allows unauthenticated attackers to achieve full system compromise by installing unauthorized firmware.

Vulnerability Details

CVE-ID: CVE-2026-44104

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, SEC-3000

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is an improper verification of cryptographic signature (CWE-347) flaw. Because the system only checks the CRC32 checksum of firmware updates, an unauthenticated attacker can bypass integrity checks to execute arbitrary code with system-level privileges.

Business Impact

The CVSS score of 9.8 reflects the high potential for total system compromise, which poses a severe risk to operational technology environments. Successful exploitation could lead to full control over charging infrastructure, resulting in significant safety hazards, equipment damage, and prolonged service downtime.

Remediation Plan

Immediate Action: Update the affected Phoenix Contact CHARX controller firmware to version 1.9.1 or later immediately.

Proactive Monitoring: Review device logs for unauthorized firmware update requests or unexpected system reboots that may indicate an attempted update.

Compensating Controls: Restrict network access to the management interfaces of these controllers to trusted internal management segments only, effectively preventing remote unauthenticated access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of secure boot or code signing mechanisms.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate patching is required to prevent unauthorized firmware modification. Administrators must prioritize updating all affected charging controllers to version 1.9.1 to ensure the integrity of the boot and update process.

Description Summary:
The CHARX OCPP Agent service on Phoenix Contact devices lacks authentication, allowing remote attackers to reconfigure backend connections and cause denial of service.

Executive Summary:
A critical missing authentication vulnerability in the CHARX OCPP Agent allows unauthenticated attackers to reconfigure backend connections, leading to denial of service and potential data disclosure.

Vulnerability Details

CVE-ID: CVE-2026-44101

Affected Software: Phoenix Contact CHARX SEC-3150 (and SEC-3100, SEC-3050, SEC-3000)

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). The OCPP Agent service fails to verify the identity of remote entities, granting an unauthenticated attacker the ability to alter backend connection settings.

Business Impact

Exploitation of this vulnerability enables attackers to disrupt charging station operations through denial of service or divert sensitive data by reconfiguring backend connections. Given the CVSS score of 9.8, the potential for service outages and information leakage is substantial. This risk is particularly high for operators of charging infrastructure who rely on secure connectivity to the backend management platform.

Remediation Plan

Immediate Action: Update the firmware of all affected CHARX SEC devices to version 1.9.1 or higher to enforce authentication for the OCPP Agent service.

Proactive Monitoring: Monitor the status of backend connections and review logs for unauthorized reconfiguration attempts or unexpected connection drops in the charging management system.

Compensating Controls: Restrict network access to the OCPP Agent service by implementing strict firewall rules and network segmentation, ensuring only verified management servers can communicate with the device.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The ability to remotely reconfigure backend connections is a critical flaw that could facilitate large-scale service disruption.

Analyst Recommendation

Operators must treat this vulnerability with high urgency to prevent potential operational downtime and data exposure. It is essential to apply the manufacturer-provided firmware updates and verify network security controls to protect the integrity of the backend management communications.

Description Summary:
The CHARX JupiCore service in various Phoenix Contact CHARX SEC controllers contains a missing authentication vulnerability, allowing unauthenticated remote attackers to reconfigure charging points.

Executive Summary:
A critical authentication bypass in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to manipulate charging point configurations, potentially causing service disruption.

Vulnerability Details

CVE-ID: CVE-2026-44100

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, and SEC-3000

Affected Versions: 1.0.0 through 1.9.0

Vulnerability: The CHARX JupiCore service fails to enforce proper authentication for critical functions. This allows an unauthenticated remote attacker to perform unauthorized reconfigurations, leading to the disclosure of sensitive UIDs, denial-of-service conditions, and file tampering.

Business Impact

The ability to manipulate industrial charging infrastructure remotely carries significant operational risk. With a CVSS score of 9.4, the vulnerability enables attackers to disrupt service availability or potentially cause physical damage to connected assets through unauthorized configuration changes, leading to severe reputational and financial impacts.

Remediation Plan

Immediate Action: Update all affected CHARX SEC controller units to firmware version 1.9.1 or later as specified by the vendor advisory.

Proactive Monitoring: Review system logs for unauthorized configuration change events and monitor for abnormal communication patterns targeting the JupiCore service.

Compensating Controls: Deploy network segmentation to isolate industrial control systems from public-facing networks and utilize industrial firewalls to restrict access to the affected service.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, involving critical function access, suggests high exploitability if the interface is reachable via the network.

Analyst Recommendation

Organizations utilizing affected Phoenix Contact hardware must prioritize the firmware update to version 1.9.1. Given the potential for operational disruption and unauthorized access, ensuring all controllers are updated is essential to maintaining the integrity of the charging infrastructure.

Description Summary:
An OS command injection vulnerability in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to execute arbitrary commands via the OCPP backend.

Executive Summary:
An OS command injection vulnerability in Phoenix Contact CHARX controllers allows unauthenticated remote attackers to execute arbitrary commands via the OCPP backend, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-44098

Affected Software: Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is an OS command injection flaw (CWE-78) triggered when an unauthenticated remote attacker bypasses firewall restrictions to interact with the OCPP backend. Successful exploitation allows the execution of arbitrary commands with the privileges of the charx-oa user.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized control over charging infrastructure, potentially causing operational disruption or unauthorized access to the underlying network. Given the CVSS score of 8.6, the risk is high: it enables attackers to manipulate controller functions without requiring valid user credentials.

Remediation Plan

Immediate Action: Update all affected CHARX SEC controller units to firmware version 1.9.1 or higher immediately.

Proactive Monitoring: Monitor network traffic for anomalous OCPP communication patterns and audit system logs for unexpected command execution attempts.

Compensating Controls: Ensure that the OCPP backend is strictly isolated from public networks and implement firewall rules to prevent unauthorized access to the management interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on a firewall bypass suggests that robust network perimeter security is a critical factor in preventing exploitation.

Analyst Recommendation

The severity of this remote, unauthenticated vulnerability necessitates immediate patching. Organizations should prioritize updating their Phoenix Contact CHARX controllers to the latest firmware to eliminate the command injection vector and secure their industrial control environment.

Description Summary:
The Phoenix Contact CHARX series is vulnerable to a fail-open condition, allowing attackers to force a fallback to a firmware partition containing default credentials.

Executive Summary:
A failure to secure the firmware partition fallback process in Phoenix Contact CHARX devices allows unauthenticated attackers to gain unauthorized access via default credentials.

Vulnerability Details

CVE-ID: CVE-2026-44094

Affected Software: Phoenix Contact CHARX SEC-3150, SEC-3100, SEC-3050, and SEC-3000

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: The devices exhibit a fail-open behavior (CWE-636) where an unauthenticated remote attacker can force a transition to a legacy or secondary firmware partition. This partition contains insecure configurations, specifically the use of default credentials, which can be exploited for unauthorized access.

Business Impact

The CVSS score of 8.6 indicates a high risk of unauthorized access and potential loss of availability. By forcing the system to a less secure state, attackers can bypass current authentication mechanisms, leading to complete device control, data exfiltration, or the disabling of charging operations.

Remediation Plan

Immediate Action: Update the affected CHARX devices to firmware version 1.9.1 or later.

Proactive Monitoring: Monitor device logs for unexpected partition changes or attempts to authenticate with default credentials.

Compensating Controls: Ensure that management interfaces are isolated from public networks and that all default passwords are changed on all accessible partitions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is an inherent design weakness in how the system handles partition fallback, making it a target for attackers seeking to bypass modern security hardening.

Analyst Recommendation

The reliance on default credentials in legacy firmware partitions presents a significant security gap. Administrators must prioritize the upgrade to version 1.9.1 to ensure that the device does not fall back to an insecure state, thereby mitigating the risk of unauthorized administrative access.

Description Summary:
A missing authentication vulnerability in the Phoenix Contact CHARX SEC series allows unauthenticated remote attackers to access and potentially compromise the MQTT broker.

Executive Summary:
A critical missing authentication flaw in Phoenix Contact CHARX SEC controllers allows unauthenticated remote attackers to gain full device control by accessing the MQTT broker.

Vulnerability Details

CVE-ID: CVE-2026-44090

Affected Software: Phoenix Contact CHARX SEC-3150 (and SEC-3100, SEC-3050, SEC-3000)

Affected Versions: 1.0.0 up to (excluding) 1.9.1

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). The MQTT broker on the affected hardware lacks proper authentication, allowing an unauthenticated remote attacker to interact with the service if network access is permitted.

Business Impact

The ability to access the MQTT broker allows an attacker to manipulate industrial control communications, leading to potential operational disruption or full device compromise. With a CVSS score of 9.8, this vulnerability poses a severe threat to operational technology environments. Unauthorized access may result in unauthorized control of physical processes, leading to safety risks and significant financial impact.

Remediation Plan

Immediate Action: Update the firmware of all affected CHARX SEC devices to version 1.9.1 or higher to implement mandatory authentication for the MQTT broker.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at the MQTT port and review device logs for suspicious configuration changes or unexpected message publishing.

Compensating Controls: Ensure that all industrial control devices are isolated from the public internet via robust firewall rules and VPNs to restrict access to the MQTT broker to authorized internal sources only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication on critical industrial protocols is a high-risk configuration that should be remediated immediately.

Analyst Recommendation

This vulnerability represents a significant risk to industrial systems and must be addressed as a high priority. Administrators should ensure that firmware updates are applied to all impacted hardware and verify that network-level controls are in place to prevent unauthorized exposure of the MQTT broker.

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in the Link Aggregation configuration interface allows remote attackers to execute unauthorized POST requests on affected Phoenix Contact switches.

Executive Summary:
A Cross-Site Request Forgery vulnerability in Phoenix Contact FL SWITCH 2000 series devices allows remote attackers to silently modify device configurations by tricking authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-22323

Affected Software: Phoenix Contact FL SWITCH 2005, 2008, 2016, 2105, 2108, and 2116

Affected Versions: 0.0.0 up to (excluding) 3.53

Vulnerability: The flaw is a Cross-Site Request Forgery (CWE-352) residing in the Link Aggregation configuration interface. While the attacker is unauthenticated, they rely on social engineering to trick an authenticated administrator into executing unauthorized state-changing POST requests.

Business Impact

The ability for an unauthorized party to modify network switch configurations poses a significant risk to industrial and enterprise infrastructure. Successful exploitation could lead to unauthorized network segmentation changes, denial of service, or the disruption of critical traffic flows, resulting in operational downtime and potential security policy bypasses. With a CVSS score of 7.1, this high-severity vulnerability requires immediate attention to prevent unauthorized configuration changes.

Remediation Plan

Immediate Action: Update all affected Phoenix Contact FL SWITCH devices to firmware version 3.53 or higher to patch the configuration interface.

Proactive Monitoring: Audit network logs for unexpected configuration changes or administrative actions originating from unauthorized sources or unusual times.

Compensating Controls: Implement strict network access control lists to limit management interface access to trusted administrative workstations only, reducing the likelihood of a successful CSRF attack.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of March 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for silent configuration modification, but it requires the active participation of an authenticated user.

Analyst Recommendation

Given the potential for unauthorized modification of network infrastructure, security teams should prioritize the firmware update for all identified Phoenix Contact switches. Until patching is complete, ensure administrative interfaces are not exposed to the public internet and educate users against clicking suspicious links while logged into device management consoles.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the Phoenix Contact FL SWITCH configuration interface allows unauthenticated remote attackers to execute malicious scripts in a victim's browser.

Executive Summary:
An unauthenticated remote attacker can inject malicious scripts into the Link Aggregation configuration of various Phoenix Contact FL SWITCH models, posing a risk of unauthorized interface manipulation.

Vulnerability Details

CVE-ID: CVE-2026-22322

Affected Software: Phoenix Contact FL SWITCH 2000 Series

Affected Versions: Phoenix Contact FL SWITCH 2005, 2008, 2016, 2105, 2108, 2116 (0.0.0 up to 3.53)

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability residing in the Link Aggregation configuration interface. An unauthenticated attacker can inject arbitrary HTML or JavaScript, which executes when an administrator views the affected page.

Business Impact

Successful exploitation allows an attacker to perform unauthorized actions within the context of the administrator's browser session. While the httpOnly flag prevents session cookie theft, the ability to manipulate the network switch configuration could lead to service disruption or unauthorized changes to industrial network traffic routing. Given the CVSS score of 7.1, this is classified as a High severity issue requiring prompt attention to maintain operational integrity.

Remediation Plan

Immediate Action: Update all affected Phoenix Contact FL SWITCH devices to firmware version 3.53 or later as specified in the vendor advisory.

Proactive Monitoring: Monitor device configuration logs for unexpected changes to Link Aggregation settings or signs of unauthorized access attempts.

Compensating Controls: Restrict access to the device management interface to trusted management subnets and employ a Web Application Firewall (WAF) to filter malicious script payloads where applicable.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, though it requires a user to navigate to the compromised page to execute the payload.

Analyst Recommendation

This vulnerability presents a significant risk to industrial control environments by allowing unauthorized configuration changes via script injection. Administrators should prioritize the deployment of the vendor-provided firmware update across all affected switch models to neutralize the attack vector. Failure to patch may leave the device interface susceptible to exploitation by remote actors.

Description Summary:
A command injection vulnerability in the Root CA certificate transfer workflow of Phoenix Contact FL SWITCH devices allows arbitrary command execution with root privileges.

Executive Summary:
A high-severity command injection vulnerability in Phoenix Contact FL SWITCH 2000 series devices allows authenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-22317

Affected Software: Phoenix Contact FL SWITCH 2000 Series

Affected Versions: 0.0.0 up to (excluding) 3.53

Vulnerability: This vulnerability is a command injection flaw (CWE-77) triggered via the Root CA certificate transfer workflow. An attacker with high-level administrative privileges can send crafted HTTP POST requests to execute arbitrary commands on the underlying Linux operating system with root-level permissions.

Business Impact

The ability to execute arbitrary commands as root grants an attacker complete control over the affected industrial network switch. Successful exploitation could lead to unauthorized network traffic interception, disruption of critical infrastructure operations, or use of the device as a pivot point for lateral movement within the production environment. Given the CVSS score of 7.2, this represents a significant risk to operational integrity and security.

Remediation Plan

Immediate Action: Update the firmware of all affected Phoenix Contact FL SWITCH devices to version 3.53 or later as specified in the vendor advisory.

Proactive Monitoring: Review device access logs for suspicious HTTP POST requests directed toward certificate management endpoints or unauthorized configuration changes.

Compensating Controls: Restrict management access to the device to a dedicated, isolated management network and utilize network segmentation to limit the exposure of the administrative interface.

Exploitation Status

Public Exploit Available: No (Exploit available: false)

Analyst Notes: As of March 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires high privileges, the impact of root-level command execution necessitates prompt patching in industrial environments.

Analyst Recommendation

Organizations utilizing affected Phoenix Contact hardware must prioritize firmware updates to version 3.53 to eliminate this command injection vector. Due to the potential for full system control and the critical nature of these devices in industrial settings, testing and deployment of these updates should be scheduled within the next standard maintenance window to mitigate the risk of unauthorized administrative abuse.

Description Summary:
A buffer overflow vulnerability in the PROFINET service of Phoenix Contact controllers allows unauthenticated remote attackers to cause a device reboot or execute arbitrary code.

Executive Summary:
Phoenix Contact controllers are susceptible to a critical buffer overflow vulnerability in their PROFINET service, which can be exploited by unauthenticated attackers to gain code execution.

Vulnerability Details

CVE-ID: CVE-2025-41769

Affected Software: Phoenix Contact AXC F 1152, AXC F 1252, AXC F 2152, AXC F 3152, BPC 9102S, and BPC 9202S

Affected Versions: 2019.0.4 up to (excluding) 2026.0.3

Vulnerability: The PROFINET service contains a classic buffer overflow (CWE-120) that permits an unauthenticated remote attacker to overflow memory buffers, leading to either a denial of service (reboot) or arbitrary code execution.

Business Impact

Exploitation of this vulnerability in industrial control systems can lead to unauthorized manipulation of physical processes, operational downtime, or the loss of sensitive control logic. Given the CVSS score of 9.8, this poses a severe risk to the availability and safety of industrial infrastructure.

Remediation Plan

Immediate Action: Update the affected Phoenix Contact devices to firmware version 2026.0.3 or later as specified by the vendor.

Proactive Monitoring: Monitor industrial network traffic for malformed PROFINET packets or unexpected device reboots.

Compensating Controls: Use industrial firewalls to isolate PROFINET traffic to trusted segments and disable unnecessary services on the controllers.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Buffer overflows in industrial protocols are historically high-value targets for threat actors.

Analyst Recommendation

Due to the critical impact on operational technology, organizations should apply the provided firmware updates as part of their next scheduled maintenance window or sooner if the devices are exposed to untrusted networks. Immediate action is required to ensure the security and stability of the affected controllers.

Description Summary:
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious configuration file, resulting in arbitrary code execution with root privileges.

Executive Summary:
A critical code injection vulnerability in Phoenix Contact TC ROUTER devices allows unauthenticated remote attackers to achieve full system compromise by tricking privileged users.

Vulnerability Details

CVE-ID: CVE-2025-41717

Affected Software: Phoenix Contact TC ROUTER

Affected Versions: TC ROUTER 3002T-3G, 2002T-3G, 3002T-4G, 3002T-4G GL, 3002T-4G VZW (versions prior to 3.08.8); TC ROUTER 5004T-5G EU (versions prior to 1.06.23).

Vulnerability: This is a code injection vulnerability (CWE-94) occurring via the config-upload endpoint. While the attacker is unauthenticated, they must perform social engineering to trick a high-privileged user into initiating the malicious file upload.

Business Impact

Successful exploitation results in a total loss of confidentiality, integrity, and availability, as the attacker gains root-level access to the affected network hardware. Given the CVSS score of 8.8, this poses a high risk to operational technology environments where these routers serve as critical communication gateways. Compromise could facilitate lateral movement into sensitive industrial control networks or complete disruption of remote connectivity.

Remediation Plan

Immediate Action: Update affected TC ROUTER firmware to version 3.08.8 or 1.06.23, respectively, as specified by the vendor advisory.

Proactive Monitoring: Monitor device logs for unauthorized or unexpected configuration upload events and unusual administrative logins.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only, and educate administrative staff on the risks of uploading configuration files from untrusted sources.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of January 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on social engineering to trick a privileged user increases the complexity of exploitation, but the resulting root access makes this a high-priority update.

Analyst Recommendation

Due to the severity of the impact and the potential for full system control, organizations using the identified Phoenix Contact TC ROUTER models must prioritize firmware updates. Administrators should ensure that management interfaces are properly firewalled to mitigate the risk of remote access until patches are successfully deployed.

Description Summary:
A command injection vulnerability in Phoenix Contact CHARX controllers allows low-privileged authenticated remote attackers to execute arbitrary code as root via the web management interface.

Executive Summary:
Phoenix Contact CHARX controllers are vulnerable to a critical command injection flaw that allows low-privileged authenticated attackers to gain full root-level control over the system.

Vulnerability Details

CVE-ID: CVE-2025-41699

Affected Software: Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150

Affected Versions: 0.0.0 up to (excluding) 1.7.4

Vulnerability: This is a command injection vulnerability (CWE-94) triggered through the web-based management interface, where improper input validation allows an authenticated user with low privileges to inject and execute system commands with root privileges.

Business Impact

A successful exploit results in a total loss of confidentiality, integrity, and availability, effectively granting the attacker full control over the affected hardware. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized industrial process manipulation, permanent system compromise, or lateral movement within the operational technology network.

Remediation Plan

Immediate Action: Update the firmware of all affected Phoenix Contact CHARX controllers to version 1.7.4 or later as specified in the vendor advisory.

Proactive Monitoring: Monitor network traffic to the web management interfaces for anomalous command patterns and review system logs for unauthorized configuration changes or unexpected process execution.

Compensating Controls: Restrict access to the web-based management interface to authorized management subnets and implement strict firewall rules to prevent unauthorized users from reaching the administration portal.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of October 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of low privilege requirements and the resulting root-level execution.

Analyst Recommendation

Due to the severity of this vulnerability and the potential for complete system compromise, administrators must prioritize the firmware update to version 1.7.4. Restricting administrative access to the web interface remains a critical defensive measure until all devices have been successfully patched.

Description Summary:
A privilege escalation vulnerability exists in the nssm.exe component of Phoenix Contact DaUM, allowing local attackers to gain administrative access due to improper permissions.

Executive Summary:
A high-severity local privilege escalation vulnerability in Phoenix Contact DaUM allows low-privileged users to achieve administrative control over the system.

Vulnerability Details

CVE-ID: CVE-2025-41686

Affected Software: Phoenix Contact DaUM

Affected Versions: 0.0.0 up to (excluding) 2025.3.1

Vulnerability: The flaw is a missing authentication for a critical function (CWE-306) residing within the nssm.exe service manager. A local attacker with low privileges can exploit these improper permissions to execute commands with elevated administrative rights.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk for organizations utilizing this software. Successful exploitation allows an attacker to bypass standard security boundaries, potentially leading to full system compromise, unauthorized data access, and the ability to install malicious software or modify critical configurations.

Remediation Plan

Immediate Action: Update Phoenix Contact DaUM to version 2025.3.1 or later to resolve the improper permission configuration in the nssm.exe component.

Proactive Monitoring: Audit local system logs for unauthorized service modifications or unexpected execution of administrative tasks by low-privileged user accounts.

Compensating Controls: Implement strict principle of least privilege policies on local Windows systems to restrict the ability of standard users to interact with service executables and modify their associated file permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 13, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the risk is localized to the host, the ability for a standard user to gain full administrative rights makes this a significant target for lateral movement within a compromised environment.

Analyst Recommendation

Given the severity of potential privilege escalation, organizations must prioritize the deployment of the vendor-supplied update across all affected DaUM installations. Administrators should verify the patch version 2025.3.1 is applied immediately to eliminate the underlying permission flaw and prevent unauthorized administrative access.

Description Summary:
A lack of data verification in the PLCnext Web-based Management allows authenticated Engineer users to achieve remote arbitrary code execution with root privileges.

Executive Summary:
A critical vulnerability in Phoenix Contact PLCnext allows authenticated low-privileged users to execute arbitrary code with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2025-41669

Affected Software: Phoenix Contact PLCnext

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from an insecure application installation process within the Web-based Management interface. An authenticated user with "Engineer" privileges can upload and install malicious packages from the PLCnext Store without sufficient validation, leading to full system compromise.

Business Impact

The ability to execute code with root privileges on a PLC device poses a severe risk to industrial operational technology (OT) environments. Successful exploitation could lead to total loss of device control, potential safety hazards, or permanent disruption of critical infrastructure processes. The CVSS score of 8.8 reflects the high potential for impact on availability and integrity.

Remediation Plan

Immediate Action: Restrict access to the Web-based Management interface to authorized personnel only and apply any available vendor security updates immediately.

Proactive Monitoring: Monitor device logs for unauthorized application installations or unusual administrative activity within the PLCnext environment.

Compensating Controls: Implement strict network segmentation to isolate PLC devices from untrusted networks and utilize industrial firewalls to inspect traffic directed at management ports.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote root-level code execution in an industrial control environment, this vulnerability must be treated with extreme urgency. Administrators should audit all current PLCnext Store applications and enforce strict least-privilege access controls until patches are verified and applied.

Description Summary:
A low privileged remote attacker can perform improper link resolution to gain arbitrary read, write, and execute access to files on Phoenix Contact PLCnext Control devices.

Executive Summary:
A critical file system vulnerability in Phoenix Contact PLCnext Control devices allows authenticated low privileged attackers to achieve full system control.

Vulnerability Details

CVE-ID: CVE-2025-41668

Affected Software: PHOENIX CONTACT AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, and RFC 4072S.

Affected Versions: All versions prior to 2025.0.2.

Vulnerability: This flaw stems from CWE-59, Improper Link Resolution Before File Access, which allows an authenticated attacker with low privileges to replace critical system files or folders used by the security-profile service.

Business Impact

Successful exploitation grants an attacker the ability to read, modify, or execute arbitrary files on the affected industrial controllers. Given the CVSS score of 8.8, this represents a high risk of unauthorized system manipulation, potentially leading to operational disruption or the compromise of sensitive industrial process data.

Remediation Plan

Immediate Action: Update all affected PLCnext Control devices to firmware version 2025.0.2 or later as specified in the vendor advisory.

Proactive Monitoring: Review system access logs for unusual file modification patterns or unauthorized attempts to access or replace configuration files within the security-profile directory.

Compensating Controls: Restrict network access to the management interfaces of these controllers to trusted administrative networks only, effectively reducing the attack surface for remote threats.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation and arbitrary file operations, making the application of vendor patches the primary security priority.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention for all organizations utilizing the affected Phoenix Contact hardware. Administrators must prioritize the deployment of the 2025.0.2 firmware update to neutralize the risk of unauthorized system file manipulation and maintain the integrity of their industrial control environment.

Description Summary:
A low privileged remote attacker can exploit improper link resolution in the arp-preinit script to gain arbitrary read, write, and execute access to files on the affected Phoenix Contact devices.

Executive Summary:
A critical file system vulnerability in multiple Phoenix Contact controllers allows low privileged remote attackers to gain full system-level access via file replacement.

Vulnerability Details

CVE-ID: CVE-2025-41667

Affected Software: Phoenix Contact AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, and RFC 4072S

Affected Versions: PHOENIX CONTACT AXC F 1152: 0 up to (excluding) 2025.0.2; AXC F 2152: 0 up to (excluding) 2025.0.2; AXC F 3152: 0 up to (excluding) 2025.0.2; BPC 9102S: 0 up to (excluding) 2025.0.2; RFC 4072S: 0 up to (excluding) 2025.0.2

Vulnerability: This flaw involves improper link resolution before file access (CWE-59) within the arp-preinit script. A low privileged, authenticated remote attacker can manipulate file links to achieve unauthorized read, write, and execute permissions on the target device.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise. Successful exploitation grants an attacker full control over the controller, which could result in severe operational disruption, the manipulation of industrial control processes, or the exfiltration of sensitive configuration data.

Remediation Plan

Immediate Action: Update the affected Phoenix Contact devices to firmware version 2025.0.2 or later as specified in the vendor advisory.

Proactive Monitoring: Review system logs for unauthorized file modification attempts or anomalous activity associated with the arp-preinit script execution.

Compensating Controls: Restrict network access to the management interfaces of these devices to trusted administrative subnets to minimize the risk of unauthorized remote access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for initial low-privileged access limits the attack surface, but the high impact of the vulnerability necessitates prompt remediation.

Analyst Recommendation

Given the potential for complete system compromise on critical industrial control hardware, administrators must prioritize the update to firmware version 2025.0.2. Organizations should verify that all listed controller models are patched across their environment to eliminate the risk of privilege escalation and unauthorized file access.

Description Summary:
A low-privileged remote attacker can replace a critical watchdog file to gain arbitrary read, write, and execute access on affected Phoenix Contact industrial controllers.

Executive Summary:
This high-severity vulnerability in Phoenix Contact controllers allows authenticated attackers to achieve full system compromise by manipulating watchdog file operations.

Vulnerability Details

CVE-ID: CVE-2025-41666

Affected Software: Phoenix Contact AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, RFC 4072S

Affected Versions: 0 up to (excluding) 2025.0.2

Vulnerability: The flaw is caused by improper link resolution (CWE-59) during file access, allowing a low-privileged authenticated user to perform file replacement attacks against the system watchdog process.

Business Impact

The ability to gain arbitrary read, write, and execute access on industrial control hardware presents a severe operational risk, potentially leading to unauthorized process manipulation, loss of control, or permanent hardware damage. With a CVSS score of 8.8, this vulnerability represents a high risk to the availability and integrity of industrial automation environments where these controllers are deployed.

Remediation Plan

Immediate Action: Update all affected Phoenix Contact devices to firmware version 2025.0.2 or later as documented in the vendor advisory.

Proactive Monitoring: Monitor system logs for unauthorized file modification attempts or unexpected behavior in the watchdog service.

Compensating Controls: Restrict network access to the management interfaces of these controllers to trusted personnel and verify that low-privileged users are not granted unnecessary file system access permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for initial low-privileged access limits its reach but does not negate the critical impact once the file system is compromised.

Analyst Recommendation

Given the potential for total system compromise in critical industrial environments, immediate patching of the affected Phoenix Contact controllers is required. Organizations should prioritize firmware updates on all internet-exposed or remotely accessible devices to mitigate the risk of unauthorized file manipulation and potential execution of malicious code.

Description Summary:
An unauthenticated remote attacker can trigger a Denial of Service on Phoenix Contact AXL F BK devices by flooding the HTTP service on port 80 with excessive requests.

Executive Summary:
A critical resource exhaustion vulnerability in Phoenix Contact AXL F BK series modules allows unauthenticated remote attackers to perform a Denial of Service attack.

Vulnerability Details

CVE-ID: CVE-2025-2813

Affected Software: Phoenix Contact AXL F BK Series

Affected Versions: AXL F BK PN (0.0-1.33), AXL F BK PN XC (0.0-1.33), AXL F BK PN discontinued (0.0-1.06), AXL F BK PN XC discontinued (0.0-1.06), AXL F BK SAS discontinued (0.0-1.35), AXL F BK ETH (0.0-1.31)

Vulnerability: This vulnerability is a resource exhaustion flaw (CWE-770) occurring because the HTTP service lacks proper request throttling, allowing an unauthenticated remote attacker to crash the service via high traffic volume.

Business Impact

The successful exploitation of this vulnerability results in a Denial of Service, which effectively takes the affected industrial communication modules offline. Given a CVSS score of 7.5, this represents a high-severity risk to operational continuity, potentially causing significant disruption to connected industrial processes and systems.

Remediation Plan

Immediate Action: Consult the official Phoenix Contact security advisory at the CERT VDE portal to identify available firmware updates or vendor-recommended configuration changes for the specific hardware revision.

Proactive Monitoring: Monitor network traffic for unusual spikes or sustained high request rates directed at port 80 on industrial control devices.

Compensating Controls: Implement network segmentation and restrict access to the web management interface of these devices to trusted management subnets only, effectively blocking untrusted remote access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its automatable nature, meaning the barrier to entry for an attacker is minimal.

Analyst Recommendation

Organizations utilizing these Phoenix Contact modules must prioritize the application of vendor patches as soon as they become available. Until updates are deployed, strict network isolation of the management interface is necessary to mitigate the risk of remote service disruption.

Description Summary:
Unauthenticated adjacent attackers can configure a new OCPP backend in Phoenix Contact CHARX controllers due to insecure default resource initialization.

Executive Summary:
A critical vulnerability in Phoenix Contact CHARX controllers allows unauthenticated attackers on the local network to gain full control over the OCPP backend configuration.

Vulnerability Details

CVE-ID: CVE-2025-25271

Affected Software: Phoenix Contact CHARX SEC-3000, 3050, 3100, and 3150

Affected Versions: 0.0.0 up to 1.7.3

Vulnerability: This vulnerability involves insecure default initialization of resources (CWE-1188), which permits an unauthenticated attacker present on the adjacent network to modify the Open Charge Point Protocol (OCPP) backend settings.

Business Impact

The ability to reconfigure the OCPP backend poses a significant risk to the integrity and availability of electric vehicle charging infrastructure. An attacker could redirect traffic to a malicious server, leading to unauthorized data exfiltration, service disruption, or full system compromise. With a CVSS score of 8.8, this flaw represents a high risk to operational continuity and physical asset security.

Remediation Plan

Immediate Action: Update all affected Phoenix Contact CHARX controllers to firmware version 1.7.3 or later as specified by the vendor advisory.

Proactive Monitoring: Monitor network traffic for unauthorized attempts to access the configuration interface or unexpected changes to OCPP backend destination URLs.

Compensating Controls: Restrict access to the management interfaces of charging controllers by implementing strict network segmentation and ensuring these devices are not exposed to untrusted adjacent network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires adjacent network access, the potential for total impact on the backend configuration makes this a high-priority update for all facility operators.

Analyst Recommendation

Given the severity of potential unauthorized configuration changes, organizations utilizing affected Phoenix Contact CHARX controllers should prioritize firmware updates immediately. Verify that all devices are properly segmented from public or untrusted network segments to minimize the attack surface while the deployment of the vendor-provided patch is completed.

Description Summary:
A command injection vulnerability in Phoenix Contact CHARX controllers allows unauthenticated local attackers to execute arbitrary commands with root privileges.

Executive Summary:
A critical command injection vulnerability in Phoenix Contact CHARX charging controllers allows unauthenticated local attackers to achieve full system compromise via root-level execution.

Vulnerability Details

CVE-ID: CVE-2025-25269

Affected Software: Phoenix Contact CHARX SEC-3000, 3050, 3100, 3150

Affected Versions: 0.0.0 up to (excluding) 1.7.3

Vulnerability: The vulnerability is an OS command injection (CWE-78) flaw triggered by improper neutralization of special elements. An unauthenticated local attacker can inject malicious commands that the system subsequently executes with root-level privileges.

Business Impact

The ability for an unauthenticated local user to gain root access poses a severe threat to operational integrity and system availability. Successful exploitation could lead to total control over the charging controller, potentially causing physical hardware damage, service disruption, or unauthorized manipulation of charging sessions. Given the CVSS score of 8.4, this vulnerability represents a high-severity risk that requires immediate attention to prevent privilege escalation within the industrial environment.

Remediation Plan

Immediate Action: Update all affected Phoenix Contact CHARX controller firmware to version 1.7.3 or later as specified in the vendor advisory.

Proactive Monitoring: Monitor system logs for unauthorized authentication attempts or unexpected shell commands executed by non-privileged accounts.

Compensating Controls: Restrict physical access to the controller devices to authorized personnel only and disable unused local interfaces to minimize the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires local access, the resulting impact of root execution makes it a high-priority target for malicious actors in physical proximity to the hardware.

Analyst Recommendation

This vulnerability presents a significant risk to the security and stability of Phoenix Contact CHARX infrastructure. Administrators must prioritize the application of the vendor-provided firmware update to version 1.7.3 to neutralize the command injection vector. Until updates are deployed, ensure that physical access controls are strictly enforced to mitigate the risk of local exploitation.

Description Summary:
An unauthenticated adjacent attacker can modify device configurations via a specific API endpoint due to missing authentication checks.

Executive Summary:
A critical authentication bypass vulnerability in Phoenix Contact CHARX SEC controllers allows unauthenticated adjacent attackers to gain unauthorized read and write access to device configurations.

Vulnerability Details

CVE-ID: CVE-2025-25268

Affected Software: Phoenix Contact CHARX SEC-3000, 3050, 3100, and 3150

Affected Versions: 0.0.0 up to (excluding) 1.7.3

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). An unauthenticated attacker positioned on the same local network segment can send crafted requests to a specific API endpoint, resulting in full read and write access to the device configuration.

Business Impact

The potential for unauthorized configuration modification poses a severe risk to industrial operations, as attackers could alter operational parameters, disable safety features, or disrupt service. With a CVSS score of 8.8, this high-severity flaw threatens the integrity and availability of critical charging infrastructure. Successful exploitation could lead to significant operational downtime and potential physical safety risks depending on the deployment environment.

Remediation Plan

Immediate Action: Update all affected Phoenix Contact CHARX SEC controller firmware to version 1.7.3 or later as specified in the vendor advisory.

Proactive Monitoring: Monitor network traffic for anomalous API calls originating from unauthorized or unexpected devices within the local network segment.

Compensating Controls: Implement network segmentation to isolate the charging controllers from untrusted devices and restrict access to the management API using firewall rules.

Exploitation Status

Public Exploit Available: No — exploit_available (false)

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered by unauthenticated attackers without requiring user interaction.

Analyst Recommendation

Given the high CVSS score and the potential for total loss of configuration control, organizations must prioritize patching these controllers immediately. If a patch cannot be applied instantly, network isolation is the most effective temporary control to prevent adjacent attackers from accessing the vulnerable API endpoint.

Description Summary:
An improper privilege management vulnerability in Phoenix Contact CHARX SEC devices allows low privileged local attackers to escalate privileges to root via insecure SSH permissions.

Executive Summary:
A local privilege escalation vulnerability in Phoenix Contact CHARX SEC charging controllers allows attackers with low-level access to gain full root control over the device.

Vulnerability Details

CVE-ID: CVE-2025-24006

Affected Software: Phoenix Contact CHARX SEC-3000, 3050, 3100, and 3150

Affected Versions: 0.0.0 up to (excluding) 1.7.3

Vulnerability: This vulnerability, categorized as CWE-269 (Improper Privilege Management), occurs due to insecure permissions configured within the SSH service. The flaw allows an already authenticated low privileged user to bypass standard access controls and execute commands with root-level privileges.

Business Impact

The ability for a low privileged attacker to escalate to root privileges poses a severe threat to operational integrity. A successful exploit could lead to complete system compromise, unauthorized modification of charging controller logic, and potential disruption of critical infrastructure services. With a CVSS score of 7.8, this high-severity flaw necessitates prompt attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Update all affected Phoenix Contact CHARX SEC devices to firmware version 1.7.3 or later as specified in the VDE-2025-014 security advisory.

Proactive Monitoring: Audit system logs for unauthorized SSH access attempts or unusual command execution patterns by non-root service accounts.

Compensating Controls: Restrict physical and network access to the SSH management interface to only authorized administration workstations to limit the exposure of the vulnerable service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which serves as a significant initial barrier to entry for potential attackers.

Analyst Recommendation

Given the potential for full system takeover, organizations utilizing Phoenix Contact CHARX SEC controllers should prioritize the application of the 1.7.3 firmware update. If immediate patching is not feasible, ensure that network-level access to the device management interfaces is strictly segmented and monitored to mitigate the risk of local escalation by unauthorized actors.

Description Summary:
A local privilege escalation vulnerability in Phoenix Contact CHARX controllers allows authenticated users to gain root access via improper input validation in a script accessible over SSH.

Executive Summary:
A local privilege escalation vulnerability in Phoenix Contact CHARX controllers allows authenticated users to gain root-level control, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-24005

Affected Software: Phoenix Contact CHARX SEC-3000, 3050, 3100, 3150

Affected Versions: 0.0.0 up to (excluding) 1.7.3

Vulnerability: This vulnerability involves improper input validation (CWE-20) within a script executed via SSH. An attacker who has already obtained a local user account can exploit this flaw to execute commands with root privileges.

Business Impact

The ability for a local user to escalate to root status represents a total compromise of the affected controller. This could lead to unauthorized configuration changes, complete loss of confidentiality and integrity for system data, and potential disruption of critical infrastructure operations. Given the CVSS score of 7.8, this is classified as a High severity issue that requires immediate attention to prevent lateral movement or permanent system damage.

Remediation Plan

Immediate Action: Update all affected Phoenix Contact CHARX controllers to firmware version 1.7.3 or later to remediate the vulnerable script.

Proactive Monitoring: Review SSH access logs for suspicious command patterns or unauthorized attempts to access administrative scripts.

Compensating Controls: Restrict SSH access to the controllers to only known, trusted administrative workstations and enforce the principle of least privilege for all local user accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for full system control, though it requires an existing local user account to trigger.

Analyst Recommendation

Organizations utilizing Phoenix Contact CHARX controllers must prioritize updating to version 1.7.3 immediately. Because this vulnerability facilitates a total compromise of the device from a low-privileged state, delaying the update increases the window of opportunity for an attacker to escalate privileges and maintain persistence on the device.

Description Summary:
An unauthenticated remote attacker can trigger out-of-bounds writes in Phoenix Contact CHARX charging stations via MQTT messages, leading to integrity loss and potential denial-of-service.

Executive Summary:
An unauthenticated remote code execution vulnerability in Phoenix Contact CHARX charging stations poses a significant risk to operational integrity and service availability.

Vulnerability Details

CVE-ID: CVE-2025-24003

Affected Software: Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150

Affected Versions: 0.0.0 through 1.6.5

Vulnerability: The vulnerability is a classic buffer overflow (CWE-120) triggered by an unauthenticated remote attacker sending malformed MQTT messages, which causes an out-of-bounds write operation within the device firmware.

Business Impact

The exploitation of this vulnerability results in a loss of integrity for the EichrechtAgent component and can lead to a denial-of-service condition for the charging station. With a CVSS score of 8.2 (High), the primary impact includes operational downtime and potential regulatory non-compliance regarding the German Calibration Law, which may necessitate costly manual interventions or service site visits.

Remediation Plan

Immediate Action: Review the official advisory at certvde.com/en/advisories/VDE-2025-014 and apply vendor-provided firmware updates as soon as they become available for your specific model.

Proactive Monitoring: Monitor network traffic for anomalous MQTT message patterns or unauthorized connections targeting the charging station management ports.

Compensating Controls: Restrict network access to the MQTT broker and charging station interfaces to trusted internal segments only, utilizing firewall rules to block unauthorized external traffic.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly automatable, meaning it is susceptible to rapid exploitation if a functional exploit were to be developed.

Analyst Recommendation

Given the unauthenticated nature of this flaw and its ability to disrupt critical charging infrastructure, administrators must prioritize this vulnerability within their patch management lifecycle. Ensure that all affected CHARX SEC units are isolated from public-facing networks until verified security patches are deployed to prevent unauthorized remote manipulation.

Description Summary:
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.

Executive Summary:
A vulnerability in multiple Phoenix Contact FL MGUARD products allows a low privileged remote attacker to acquire the root password due to improper handling of sensitive information.

Vulnerability Details

CVE-ID: CVE-2024-43384

Affected Software: Phoenix Contact FL MGUARD

Affected Versions: PHOENIX CONTACT FL MGUARD 2102: 0 up to (excluding) 10.4.1, PHOENIX CONTACT FL MGUARD 2105: 0 up to (excluding) 10.4.1, PHOENIX CONTACT FL MGUARD 4102 PCI: 0 up to (excluding) 10.4.1, PHOENIX CONTACT FL MGUARD 4102 PCIE: 0 up to (excluding) 10.4.1, PHOENIX CONTACT FL MGUARD 4302: 0 up to (excluding) 10.4.1, PHOENIX CONTACT FL MGUARD 4305: 0 up to (excluding) 10.4.1

Vulnerability: This is an improper removal of sensitive information before storage or transfer flaw, classified as CWE-212, which can be exploited by an authenticated attacker with low privileges via network access.

Business Impact

A successful exploit grants an attacker full root level control over the affected network security devices, potentially leading to total compromise of network traffic, confidentiality breaches, and system availability disruption. With a CVSS score of 8.0, this high severity vulnerability poses significant risk to industrial control environments where secure perimeter defense is critical.

Remediation Plan

Immediate Action: Update affected Phoenix Contact FL MGUARD devices to version 10.4.1 or later following the vendor security advisory.

Proactive Monitoring: Monitor network security logs and administrative access records for unauthorized login attempts or unexpected privilege escalation.

Compensating Controls: Restrict management interface access to trusted internal management networks and employ strict firewall rules to limit exposure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw allows lateral movement and total compromise if credentials are leaked.

Analyst Recommendation

Given the high CVSS score and the severe impact of root credential exposure, administrators must prioritize updating vulnerable Phoenix Contact devices. Apply the vendor security updates immediately to mitigate the risk of full system compromise.