A critical command injection vulnerability in Phoenix Contact charging controllers allows unauthenticated attackers to execute arbitrary code with root-level privileges.

This is a command injection (CWE-77) flaw where input is not properly sanitized before being passed to a system command. An unauthenticated attacker can inject malicious commands, which the system then executes with root permissions.

The CVSS score of 9.8 underscores the extreme severity of this flaw. Full root access grants an attacker the ability to manipulate charging parameters, install persistent malware, or disable safety mechanisms, which could have catastrophic impacts on both physical equipment and operational safety.

Immediate Action: Update the affected Phoenix Contact CHARX controller firmware to version 1.9.1 or later to implement proper input sanitization.

Proactive Monitoring: Audit system logs for anomalous command execution patterns or unexpected changes to system configuration files.

Compensating Controls: Implement strict network ingress filtering to ensure that only authorized traffic can reach the configuration interfaces of the charging controllers.

Public Exploit Available: No

Command injection vulnerabilities are high-priority targets for attackers. It is imperative that all affected CHARX controllers are updated to version 1.9.1 immediately to close this vector and prevent unauthorized root access to the underlying operating system.