by Kastro
Paper/Archive/CVE-2026-44104

CVE-2026-44104

Phoenix Contact CHARX SEC-3150 — ControllerAgent does not perform validation of firmware

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.4.354 × 207.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

Affected

ProductAffectedFixed inSource
CHARX SEC-31501.0.0 – < 1.9.11.9.1CNA
CHARX SEC-31001.0.0 – < 1.9.11.9.1CNA
CHARX SEC-30501.0.0 – < 1.9.11.9.1CNA
CHARX SEC-30001.0.0 – < 1.9.11.9.1CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CERTVDE (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/en/advisories/VDE-2026-008