Missing authentication in Phoenix Contact CHARX SEC-3xxx OCPP Agent service (CVE-2026-44101)

The CHARX OCPP Agent service in Phoenix Contact CHARX SEC-3xxx EV charging controllers lacks authentication, allowing an unauthenticated remote attacker to reconfigure the backend connection. This can result in Denial-of-Service and disclosure of confidential data to the attacker. Affected versions: - CHARX SEC-3000 Firmware <FW 1.9.1 - CHARX SEC-3050 Firmware <FW 1.9.1 - CHARX SEC-3100 Firmware <FW 1.9.1 - CHARX SEC-3150 Firmware <FW 1.9.1 We recommend updating to: FW 1.9.1. CVSS 9.3 · our assessment: act_now Reference: https://www.certvde.com/en/advisories/VDE-2026-008/ Details: https://vuln.today/cve/CVE-2026-44101