An unauthenticated remote code execution vulnerability in Phoenix Contact CHARX charging stations poses a significant risk to operational integrity and service availability.

The vulnerability is a classic buffer overflow (CWE-120) triggered by an unauthenticated remote attacker sending malformed MQTT messages, which causes an out-of-bounds write operation within the device firmware.

The exploitation of this vulnerability results in a loss of integrity for the EichrechtAgent component and can lead to a denial-of-service condition for the charging station. With a CVSS score of 8.2 (High), the primary impact includes operational downtime and potential regulatory non-compliance regarding the German Calibration Law, which may necessitate costly manual interventions or service site visits.

Immediate Action: Review the official advisory at certvde.com/en/advisories/VDE-2025-014 and apply vendor-provided firmware updates as soon as they become available for your specific model.

Proactive Monitoring: Monitor network traffic for anomalous MQTT message patterns or unauthorized connections targeting the charging station management ports.

Compensating Controls: Restrict network access to the MQTT broker and charging station interfaces to trusted internal segments only, utilizing firewall rules to block unauthorized external traffic.

Public Exploit Available: No (exploit_available: false)

Given the unauthenticated nature of this flaw and its ability to disrupt critical charging infrastructure, administrators must prioritize this vulnerability within their patch management lifecycle. Ensure that all affected CHARX SEC units are isolated from public-facing networks until verified security patches are deployed to prevent unauthorized remote manipulation.