Executive brief
Phoenix Contact CHARX charging controllers, used to manage electric vehicle charging stations, contain a flaw in how they handle software updates. The system only checks for basic data errors rather than verifying that the update is authentic and comes from the manufacturer. This allows a remote attacker to install malicious software on the controller, potentially taking full control of the charging station and disrupting operations.
Technical details
The firmware update process for the basemodule of CHARX SEC-3xxx charging controllers (models 3000, 3050, 3100, and 3150) only validates the CRC32 checksum of update packages. It lacks cryptographic signature verification (CWE-347), which is necessary to ensure the authenticity and integrity of the firmware. An unauthenticated remote attacker can exploit this by delivering a modified or malicious firmware image to the device. Successful exploitation results in full system compromise, including loss of confidentiality, integrity, and availability. The vulnerability is addressed in firmware version 1.9.1.
Affected products
- Phoenix Contact CHARX SEC-3000 < 1.9.1
- Phoenix Contact CHARX SEC-3050 < 1.9.1
- Phoenix Contact CHARX SEC-3100 < 1.9.1
- Phoenix Contact CHARX SEC-3150 < 1.9.1
Timeline
- 2026-07-30: advisory: VDE-2026-008 published by CERT VDE
- 2026-07-30: disclosed: CVE-2026-44104 published to NVD