Command injection in Phoenix Contact CHARX SEC-3xxx charging controllers (CVE-2026-7849)

An improper neutralization of special elements in the firmware of Phoenix Contact CHARX SEC-3xxx EV charging controllers allows an unauthenticated remote attacker to inject a command into the system configuration. The injected command is subsequently executed as root, resulting in a complete loss of confidentiality, integrity, and availability of the affected device. Affected versions: - CHARX SEC-3000 Firmware <FW 1.9.1 - CHARX SEC-3050 Firmware <FW 1.9.1 - CHARX SEC-3100 Firmware <FW 1.9.1 - CHARX SEC-3150 Firmware <FW 1.9.1 We recommend updating to: FW 1.9.1. CVSS 9.3 · our assessment: act_now Reference: https://www.certvde.com/en/advisories/VDE-2026-008/ Details: https://vuln.today/cve/CVE-2026-7849