A critical race condition in Phoenix Contact charging controllers exposes internal services to remote attackers during the system shutdown process.

This is an incorrect behavior order (CWE-696) vulnerability. The firewall is shut down before other services, creating a temporary, exploitable window where internal network services are reachable by unauthenticated remote actors.

With a CVSS score of 9.8, this vulnerability represents a high risk of unauthorized access to sensitive internal services. An attacker could leverage this window to gain a foothold in the controller, potentially leading to full system compromise or lateral movement within the operational network.

Immediate Action: Update the affected Phoenix Contact CHARX controller firmware to version 1.9.1 or later to correct the service shutdown sequence.

Proactive Monitoring: Monitor network traffic for unusual connection attempts during periods of system maintenance or expected reboots.

Compensating Controls: Isolate the controllers within a restricted VLAN and utilize firewall rules to block unsolicited incoming traffic, even if the device internal firewall is temporarily disabled.

Public Exploit Available: No

The vulnerability highlights a critical flaw in the system shutdown sequence that exposes internal services. Organizations must apply the vendor-provided firmware update to version 1.9.1 as soon as possible to ensure the firewall remains active until all services are safely terminated.