CVE-2025-25270: falha crítica em Phoenix Contact CHARX SEC-3000
Remote Code Execution via Unauthenticated Configuration Manipulation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.8%
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Phoenix Contact · CHARX SEC-3000Phoenix Contact · CHARX SEC-3050Phoenix Contact · CHARX SEC-3100Phoenix Contact · CHARX SEC-3150CVEs relacionadas — Phoenix Contact CHARX SEC-3000
No mesmo produto, das mais perigosas para as menos.
CVE-2026-44098HIGHOS Command Injection in OCPP Agent via charge_box_idEPSS 1.7%CVE-2025-41699HIGHPhoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllersEPSS 0.8%CVE-2026-44108CRITICALFirewall bypass during shutdownEPSS 0.8%CVE-2026-7849CRITICALCommand Injection in SCM (idledisconnect parameter)EPSS 0.8%CVE-2026-44101CRITICALOCPP reconfiguration vulnerabilityEPSS 0.7%CVE-2026-44090CRITICALMissing authentication for MQTT BrokerEPSS 0.7%