CVE-2026-44108: falha crítica em Phoenix Contact CHARX SEC-3000
Firewall bypass during shutdown
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.8%
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Phoenix Contact · CHARX SEC-3000Phoenix Contact · CHARX SEC-3050Phoenix Contact · CHARX SEC-3100Phoenix Contact · CHARX SEC-3150CVEs relacionadas — Phoenix Contact CHARX SEC-3000
No mesmo produto, das mais perigosas para as menos.
CVE-2026-44098HIGHOS Command Injection in OCPP Agent via charge_box_idEPSS 1.7%CVE-2025-41699HIGHPhoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllersEPSS 0.8%CVE-2026-7849CRITICALCommand Injection in SCM (idledisconnect parameter)EPSS 0.8%CVE-2025-25270CRITICALRemote Code Execution via Unauthenticated Configuration ManipulationEPSS 0.8%CVE-2026-44101CRITICALOCPP reconfiguration vulnerabilityEPSS 0.7%CVE-2026-44090CRITICALMissing authentication for MQTT BrokerEPSS 0.7%