by Kastro
Paper/Archive/CVE-2026-44092

CVE-2026-44092

Phoenix Contact CHARX SEC-3150 — Missing input validation / stripping of CRLF characters in SystemConfigManager

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 52.5.525 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

Affected

ProductAffectedFixed inSource
CHARX SEC-31501.0.0 – < 1.9.11.9.1CNA
CHARX SEC-31001.0.0 – < 1.9.11.9.1CNA
CHARX SEC-30501.0.0 – < 1.9.11.9.1CNA
CHARX SEC-30001.0.0 – < 1.9.11.9.1CNA

Scores by source

CERTVDE (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CERTVDE (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcertvde.com/en/advisories/VDE-2026-008