# CVE-2026-7849: Phoenix Contact CHARX SEC command injection in system configuration

Source: https://junglewise.ai/threats/cve-2026-7849-phoenix-contact-charx-sec-command-injection-in-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-7849 · Severity: critical · CVSS 9.8 · Published 2026-07-30

Phoenix Contact CHARX SEC charging controllers, used to manage electric vehicle (EV) charging stations, are vulnerable to a critical security flaw. An unauthenticated attacker can remotely inject malicious commands into the device's configuration, leading to full control over the controller. This could result in a complete shutdown of charging services, theft of sensitive data, or unauthorized modification of charging parameters.

Technologies: [Phoenix Contact CHARX SEC-3000](https://junglewise.ai/threats/technologies/charx-sec-3000), [Phoenix Contact CHARX SEC-3050](https://junglewise.ai/threats/technologies/charx-sec-3050), [Phoenix Contact CHARX SEC-3100](https://junglewise.ai/threats/technologies/charx-sec-3100), [Phoenix Contact CHARX SEC-3150](https://junglewise.ai/threats/technologies/charx-sec-3150). Vendors: [Phoenix Contact](https://junglewise.ai/threats/vendors/phoenix-contact).

## Quick answers

**Is CVE-2026-7849 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7849 being exploited in the wild.

**How severe is CVE-2026-7849?** Critical severity, with a CVSS score of 9.8, published 30 July 2026.

**Which products and versions are affected?** Phoenix Contact CHARX SEC-3000 1.0.0 to 1.9.1 (exclusive); Phoenix Contact CHARX SEC-3050 1.0.0 to 1.9.1 (exclusive); Phoenix Contact CHARX SEC-3100 1.0.0 to 1.9.1 (exclusive); Phoenix Contact CHARX SEC-3150 1.0.0 to 1.9.1 (exclusive).

**Is there a fix for CVE-2026-7849?** A patch was published on 2026-07-30: Firmware version 1.9.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7849 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-7849?** Check whether you run Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability (CWE-77) exists in the firmware of Phoenix Contact CHARX SEC-3xxx series charging controllers. The flaw stems from improper neutralization of special elements within the system configuration component. An unauthenticated remote attacker can exploit this by sending specially crafted input that is processed by the configuration engine, leading to arbitrary command execution with root privileges. The vulnerability affects firmware versions prior to 1.9.1. A patch has been released in firmware version 1.9.1 to address this issue.

## Affected products

- Phoenix Contact CHARX SEC-3000 1.0.0 to 1.9.1 (exclusive)
- Phoenix Contact CHARX SEC-3050 1.0.0 to 1.9.1 (exclusive)
- Phoenix Contact CHARX SEC-3100 1.0.0 to 1.9.1 (exclusive)
- Phoenix Contact CHARX SEC-3150 1.0.0 to 1.9.1 (exclusive)

## Timeline

- 2026-07-30: advisory: Advisory VDE-2026-008 published by CERT VDE
- 2026-07-30: patched: Firmware version 1.9.1 released to address the vulnerability

## References

- [https://www.certvde.com/en/advisories/VDE-2026-008/](https://www.certvde.com/en/advisories/VDE-2026-008/)

## Related threats

- [Phoenix Contact CHARX SEC-3xxx firewall bypass during shutdown](https://junglewise.ai/threats/cve-2026-44108-phoenix-contact-charx-sec-3xxx-firewall-bypass-during-shutdown)
- [Phoenix Contact CHARX SEC charging controller unauthenticated reboot via Modbus TCP](https://junglewise.ai/threats/cve-2026-44107-phoenix-contact-charx-sec-charging-controller-unauthenticated)
- [Phoenix Contact CHARX SEC-3xxx privilege escalation in init-script](https://junglewise.ai/threats/cve-2026-44106-phoenix-contact-charx-sec-3xxx-privilege-escalation-in-init)
- [Phoenix Contact CHARX SEC-3xxx credential exposure in log files](https://junglewise.ai/threats/cve-2026-44105-phoenix-contact-charx-sec-3xxx-credential-exposure-in-log-files)
- [Phoenix Contact CHARX SEC firmware update signature bypass](https://junglewise.ai/threats/cve-2026-44104-phoenix-contact-charx-sec-firmware-update-signature-bypass)