Unsigned firmware update in Phoenix Contact CHARX SEC-3xxx charging controllers (CVE-2026-44104)

The firmware update process for the basemodule of the CHARX SEC-3xxx charging controllers validates only a CRC32 checksum and performs no cryptographic signature verification. An unauthenticated remote attacker can exploit this flaw to install modified firmware, resulting in full system compromise. Affected versions: - CHARX SEC-3000 Firmware <FW 1.9.1 - CHARX SEC-3050 Firmware <FW 1.9.1 - CHARX SEC-3100 Firmware <FW 1.9.1 - CHARX SEC-3150 Firmware <FW 1.9.1 We recommend updating to: FW 1.9.1. CVSS 9.3 · our assessment: act_now Reference: https://www.certvde.com/en/advisories/VDE-2026-008/ Details: https://vuln.today/cve/CVE-2026-44104