CVE-2026-41032: Phoenix Contact CHARX SEC-3xxx unauthenticated log download

CVE-2026-41032 · Severity: high · CVSS 7.5 · Published 2026-06-03

Phoenix Contact CHARX SEC-3xxx controllers are used to manage electric vehicle (EV) charging stations. A security vulnerability in these controllers allows an unauthorized person on the same network to download system log files. This could lead to the exposure of sensitive operational data or configuration details, potentially aiding further attacks on the charging infrastructure.

Technologies: Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100, Phoenix Contact CHARX SEC-3150. Vendors: Phoenix Contact.

Quick answers

Is CVE-2026-41032 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41032 being exploited in the wild.
How severe is CVE-2026-41032?
High severity, with a CVSS score of 7.5, published 3 June 2026.
Which products and versions are affected?
Phoenix Contact CHARX SEC-3000 < 1.9.0; Phoenix Contact CHARX SEC-3050 < 1.9.0; Phoenix Contact CHARX SEC-3100 < 1.9.0; Phoenix Contact CHARX SEC-3150 < 1.9.0.
Is there a fix for CVE-2026-41032?
A patch was published on 2026-06-03: Firmware version 1.9.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41032 attacked?
It is attacked over the network or from the adjacent network, in device firmware.
Am I affected by CVE-2026-41032?
Check whether you run Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) exists in the firmware of Phoenix Contact CHARX SEC-3xxx charging controllers. The flaw allows an unauthenticated attacker with network access (specifically adjacent network access according to the summary, though the CVSS vector indicates Network) to download system log files without providing credentials. This occurs due to insufficient access control on the log retrieval endpoint. Successful exploitation can result in the disclosure of restricted information contained within the logs. The issue is resolved in firmware version 1.9.0.

Affected products

  • Phoenix Contact CHARX SEC-3000 < 1.9.0
  • Phoenix Contact CHARX SEC-3050 < 1.9.0
  • Phoenix Contact CHARX SEC-3100 < 1.9.0
  • Phoenix Contact CHARX SEC-3150 < 1.9.0

Timeline

  • 2026-06-03: disclosed: Initial advisory release by CERT@VDE and Phoenix Contact
  • 2026-06-03: patched: Firmware version 1.9.0 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.