Missing authentication for MQTT broker in Phoenix Contact CHARX SEC-3xxx (CVE-2026-44090)

The MQTT broker on Phoenix Contact CHARX SEC-3xxx EV charging controllers lacks authentication, allowing an unauthenticated remote attacker to access it directly. The broker is only protected from external access by a firewall, which an attacker may bypass. Successful exploitation may lead to full device compromise. Affected versions: - CHARX SEC-3000 Firmware <FW 1.9.1 - CHARX SEC-3050 Firmware <FW 1.9.1 - CHARX SEC-3100 Firmware <FW 1.9.1 - CHARX SEC-3150 Firmware <FW 1.9.1 We recommend updating to: FW 1.9.1. CVSS 9.3 · our assessment: act_now Reference: https://www.certvde.com/en/advisories/VDE-2026-008/ Details: https://vuln.today/cve/CVE-2026-44090