CVE-2026-44090: Phoenix Contact CHARX SEC missing authentication in MQTT broker

CVE-2026-44090 · Severity: critical · CVSS 9.8 · Published 2026-07-30

Phoenix Contact CHARX SEC charging controllers, which manage electric vehicle charging stations, contain a security flaw where a critical internal communication component (the MQTT broker) lacks password protection. If an attacker bypasses the external firewall, they can gain full control over the charging controller. This could lead to a complete service outage, unauthorized access to charging data, or total device compromise.

Technologies: Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100, Phoenix Contact CHARX SEC-3150. Vendors: Phoenix Contact.

Quick answers

Is CVE-2026-44090 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44090 being exploited in the wild.
How severe is CVE-2026-44090?
Critical severity, with a CVSS score of 9.8, published 30 July 2026.
Which products and versions are affected?
Phoenix Contact CHARX SEC-3000 < 1.9.1; Phoenix Contact CHARX SEC-3050 < 1.9.1; Phoenix Contact CHARX SEC-3100 < 1.9.1; Phoenix Contact CHARX SEC-3150 < 1.9.1.
Is there a fix for CVE-2026-44090?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44090 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-44090?
Check whether you run Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in the MQTT broker of Phoenix Contact CHARX SEC-3xxx series charging controllers. The broker is intended to be protected by an external firewall, but it does not implement its own authentication mechanisms. An unauthenticated remote attacker who can reach the broker over the network can interact with internal messaging, potentially leading to full system compromise. This issue is addressed in firmware version 1.9.1.

Affected products

  • Phoenix Contact CHARX SEC-3000 < 1.9.1
  • Phoenix Contact CHARX SEC-3050 < 1.9.1
  • Phoenix Contact CHARX SEC-3100 < 1.9.1
  • Phoenix Contact CHARX SEC-3150 < 1.9.1

Timeline

  • 2026-07-30: advisory: VDE-2026-008 published by CERT VDE
  • 2026-07-30: disclosed: CVE-2026-44090 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.