CVE-2026-44104criticalCWE-347

CVE-2026-44104: falha crítica em Phoenix Contact CHARX SEC-3000

ControllerAgent does not perform validation of firmware

Publicada em

Seguir esta CVE+ Monitorar CHARX SEC-3000+ Monitorar CHARX SEC-3050

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.4%
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Phoenix Contact · CHARX SEC-3000Phoenix Contact · CHARX SEC-3050Phoenix Contact · CHARX SEC-3100Phoenix Contact · CHARX SEC-3150
CVEs relacionadas — Phoenix Contact CHARX SEC-3000

No mesmo produto, das mais perigosas para as menos.

CVE-2026-44098HIGHOS Command Injection in OCPP Agent via charge_box_idEPSS 1.7%CVE-2025-41699HIGHPhoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllersEPSS 0.8%CVE-2026-44108CRITICALFirewall bypass during shutdownEPSS 0.8%CVE-2026-7849CRITICALCommand Injection in SCM (idledisconnect parameter)EPSS 0.8%CVE-2025-25270CRITICALRemote Code Execution via Unauthenticated Configuration ManipulationEPSS 0.8%CVE-2026-44101CRITICALOCPP reconfiguration vulnerabilityEPSS 0.7%