CVE-2025-24004: fallo de gravedad media en Phoenix Contact CHARX SEC-3000
USB-C Buffer Overflow via Display Interface in EV Charging Stations
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.2epss 0.2%
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Productos afectados
Phoenix Contact · CHARX SEC-3000Phoenix Contact · CHARX SEC-3050Phoenix Contact · CHARX SEC-3100Phoenix Contact · CHARX SEC-3150CVEs relacionadas — Phoenix Contact CHARX SEC-3000
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-44098HIGHOS Command Injection in OCPP Agent via charge_box_idEPSS 1.7%CVE-2025-41699HIGHPhoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllersEPSS 0.8%CVE-2026-44108CRITICALFirewall bypass during shutdownEPSS 0.8%CVE-2026-7849CRITICALCommand Injection in SCM (idledisconnect parameter)EPSS 0.8%CVE-2025-25270CRITICALRemote Code Execution via Unauthenticated Configuration ManipulationEPSS 0.8%CVE-2026-44101CRITICALOCPP reconfiguration vulnerabilityEPSS 0.7%