Firewall shutdown race condition in Phoenix Contact CHARX SEC-3xxx charging controllers (CVE-2026-44108)

A flaw in the execution order of scripts during system shutdown causes the firewall to terminate prematurely, creating a temporary window in which internal services become externally accessible. An unauthenticated remote attacker may exploit this window to connect to otherwise protected internal services, potentially resulting in full system compromise. Affected versions: - CHARX SEC-3000 Firmware <FW 1.9.1 - CHARX SEC-3050 Firmware <FW 1.9.1 - CHARX SEC-3100 Firmware <FW 1.9.1 - CHARX SEC-3150 Firmware <FW 1.9.1 We recommend updating to: FW 1.9.1. CVSS 9.3 · our assessment: act_now Reference: https://www.certvde.com/en/advisories/VDE-2026-008/ Details: https://vuln.today/cve/CVE-2026-44108