CVE-2026-44094: Phoenix Contact CHARX SEC insecure firmware fallback

CVE-2026-44094 · Severity: high · CVSS 8.6 · Published 2026-07-30

Phoenix Contact CHARX SEC charging controllers, which manage electric vehicle charging stations, contain a vulnerability that allows an attacker to force the device into an insecure state. By triggering a fallback to an older firmware version, an attacker can gain unauthorized access to the system using default credentials. This could lead to the interruption of vehicle charging services and unauthorized access to the device's operating system.

Vendors: Phoenix Contact.

Quick answers

Is CVE-2026-44094 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44094 being exploited in the wild.
How severe is CVE-2026-44094?
High severity, with a CVSS score of 8.6, published 30 July 2026.
Which products and versions are affected?
Phoenix Contact CHARX SEC-3000 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3050 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3100 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3150 Firmware < 1.9.1.
Is there a fix for CVE-2026-44094?
A patch was published on 2026-07-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44094 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-44094?
Check whether you run Phoenix Contact CHARX SEC-3000 Firmware, Phoenix Contact CHARX SEC-3050 Firmware, Phoenix Contact CHARX SEC-3100 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as a 'Failing Open' (CWE-636) flaw within the firmware management of Phoenix Contact CHARX SEC-3xxx devices. An unauthenticated remote attacker can manipulate the system to trigger a fallback mechanism to a secondary firmware partition. This secondary partition contains an insecure configuration, specifically default credentials for the 'user-app' account. Successful exploitation allows the attacker to establish an SSH connection to the device, potentially leading to a denial-of-service for charging operations and further lateral movement or system tampering. The issue is addressed in firmware version 1.9.1.

Affected products

  • Phoenix Contact CHARX SEC-3000 Firmware < 1.9.1
  • Phoenix Contact CHARX SEC-3050 Firmware < 1.9.1
  • Phoenix Contact CHARX SEC-3100 Firmware < 1.9.1
  • Phoenix Contact CHARX SEC-3150 Firmware < 1.9.1

Timeline

  • 2026-07-30: advisory
  • 2026-07-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.