Phoenix Contact CHARX CVE-2026-41032

Attacker must have network adjacency to a CHARX SEC-3000/3050/3100/3150 controller (per the description's 'adjacent' wording, despite the CVSS AV:N marking - this inconsistency should be confirmed with CERT@VDE); no credentials, no user interaction, and no special device configuration are required because the log-download interface is reachable without authentication. Exploitation is limited by the requirement for layer-2 or routed-but-segment-local access, so well-segmented deployments where the controller's management interface is isolated from general operator and public networks substantially reduce realistic exposure; conversely, public-charging deployments with flat networks or exposed maintenance ports are immediately at risk.

CVSS 7.5 (High) is driven by Confidentiality:High with no authentication or user interaction required, but the CVSS string here (AV:N) conflicts with the description, which explicitly states an 'adjacent' attacker - typically AV:A. This discrepancy should be verified against the vendor/CERT@VDE advisory, as it materially affects exposure: AV:A limits exploitation to the same broadcast/network segment, whereas AV:N would imply internet-reachable exposure. EPSS, KEV status, and SSVC decision data were not provided, so likelihood signals are incomplete; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net risk is meaningful for operators of public/semi-public EVSE infrastructure where adjacent network access is realistic (shared maintenance VLANs, exposed OT segments) but lower for well-segmented deployments.

An attacker who gains a foothold on the same charging station LAN - for example via an exposed Ethernet port on a public charger cabinet, a compromised maintenance laptop, or a flat OT segment - issues an unauthenticated request to the controller's log endpoint and downloads the log files. The retrieved logs are then mined for credentials, OCPP backend URLs, session tokens, or topology data to pivot deeper into the EV charging operator's infrastructure.