Phoenix Contact Charx SEC 3100 vulnerabilities, page 2
51 vulnerabilities
Known vulnerabilities in Phoenix Contact Charx SEC 3100, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-25999phoenix contactcharx sec-3000+7
EPSS score0.41%
An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service.CVE-2024-25994phoenix contactcharx sec-3000+7EPSS score0.73%
An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only.CVE-2024-25997phoenix contactcharx sec-3000+7EPSS score0.69%
An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected.CVE-2024-25995phoenix contactcharx sec-3000+7EPSS score1.40%
An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation.CVE-2024-28133phoenix contactcharx sec-3000+7EPSS score0.38%
A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root
privileges.CVE-2024-28134phoenix contactcharx sec-3000+7EPSS score0.49%
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based
management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.CVE-2024-28135phoenix contactcharx sec-3000+7EPSS score1.26%
A low privileged remote attacker can use a command injection vulnerability in the API which performs
remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.CVE-2024-28136phoenix contactcharx sec-3000+7EPSS score0.75%
A local attacker with low privileges can use a command injection vulnerability to gain root
privileges due to improper input validation using the OCPP Remote service.CVE-2024-28137phoenix contactcharx sec-3000+7EPSS score0.25%
A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability.CVE-2024-6788phoenix contactcharx sec-3000+7EPSS score0.50%
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.CVE-2026-41032phoenix contactcharx sec-3000+3EPSS score0.43%
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.CVE-2026-7849phoenix contactcharx sec-3000+3EPSS score0.75%
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.CVE-2026-44103phoenix contactcharx sec-3000+3EPSS score0.40%
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.CVE-2026-44097phoenix contactcharx sec-3000+3EPSS score0.43%
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.CVE-2026-44105phoenix contactcharx sec-3000+3EPSS score0.14%
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.CVE-2026-44094phoenix contactcharx sec-3000+3EPSS score0.45%
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.CVE-2026-44095phoenix contactcharx sec-3000+3EPSS score0.19%
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.CVE-2026-44108phoenix contactcharx sec-3000+3EPSS score0.83%
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.CVE-2026-44100phoenix contactcharx sec-3000+3EPSS score0.50%
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.CVE-2026-44098phoenix contactcharx sec-3000+3EPSS score1.66%
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.