# CVE-2026-44100: Phoenix Contact CHARX SEC JupiCore missing authentication

Source: https://junglewise.ai/threats/cve-2026-44100-phoenix-contact-charx-sec-jupicore-missing-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-44100 · Severity: critical · CVSS 9.4 · Published 2026-07-30

Phoenix Contact CHARX SEC charging controllers, which manage electric vehicle charging stations, contain a security flaw in their JupiCore service. An unauthorized person can remotely reconfigure charging points without needing a password. This could allow an attacker to disrupt charging services, tamper with system files, or access sensitive charging point identifiers.

Technologies: [Phoenix Contact CHARX SEC-3000](https://junglewise.ai/threats/technologies/charx-sec-3000), [Phoenix Contact CHARX SEC-3050](https://junglewise.ai/threats/technologies/charx-sec-3050), [Phoenix Contact CHARX SEC-3100](https://junglewise.ai/threats/technologies/charx-sec-3100), [Phoenix Contact CHARX SEC-3150](https://junglewise.ai/threats/technologies/charx-sec-3150). Vendors: [Phoenix Contact](https://junglewise.ai/threats/vendors/phoenix-contact).

## Quick answers

**Is CVE-2026-44100 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44100 being exploited in the wild.

**How severe is CVE-2026-44100?** Critical severity, with a CVSS score of 9.4, published 30 July 2026.

**Which products and versions are affected?** Phoenix Contact CHARX SEC-3000 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3050 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3100 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3150 Firmware < 1.9.1.

**Is there a fix for CVE-2026-44100?** A patch was published on 2026-07-30: Firmware version 1.9.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44100 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-44100?** Check whether you run Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authentication vulnerability (CWE-306) exists in the JupiCore service of Phoenix Contact CHARX SEC-3xxx charging controllers. An unauthenticated remote attacker can exploit this flaw to reconfigure charging points via the network. Successful exploitation can lead to the disclosure of charging point Unique Identifiers (UIDs), file tampering, and a denial-of-service (DoS) condition. The vulnerability is addressed in firmware version 1.9.1.

## Affected products

- Phoenix Contact CHARX SEC-3000 Firmware < 1.9.1
- Phoenix Contact CHARX SEC-3050 Firmware < 1.9.1
- Phoenix Contact: CHARX SEC-3100 Firmware < 1.9.1
- Phoenix Contact CHARX SEC-3150 Firmware < 1.9.1

## Timeline

- 2026-07-30: advisory: VDE-2026-008 published by CERT VDE
- 2026-07-30: patched: Firmware version 1.9.1 released to address the issue

## References

- [https://www.certvde.com/en/advisories/VDE-2026-008/](https://www.certvde.com/en/advisories/VDE-2026-008/)

## Related threats

- [Phoenix Contact CHARX SEC command injection in system configuration](https://junglewise.ai/threats/cve-2026-7849-phoenix-contact-charx-sec-command-injection-in-system)
- [Phoenix Contact CHARX SEC-3xxx firewall bypass during shutdown](https://junglewise.ai/threats/cve-2026-44108-phoenix-contact-charx-sec-3xxx-firewall-bypass-during-shutdown)
- [Phoenix Contact CHARX SEC charging controller unauthenticated reboot via Modbus TCP](https://junglewise.ai/threats/cve-2026-44107-phoenix-contact-charx-sec-charging-controller-unauthenticated)
- [Phoenix Contact CHARX SEC-3xxx privilege escalation in init-script](https://junglewise.ai/threats/cve-2026-44106-phoenix-contact-charx-sec-3xxx-privilege-escalation-in-init)
- [Phoenix Contact CHARX SEC-3xxx credential exposure in log files](https://junglewise.ai/threats/cve-2026-44105-phoenix-contact-charx-sec-3xxx-credential-exposure-in-log-files)