Which versions of CHARX SEC are affected by CVE-2026-44093?

Phoenix Contact CHARX SEC EV charging controllers (firmware versions 1.0.0-1.9.0) contain a privilege escalation vulnerability enabling local device access to escalate to full administrative control…. A patch is available.

How to fix or mitigate CVE-2026-44093?

Within 24 hours, identify all Phoenix Contact CHARX SEC controllers (models SEC-3000, SEC-3050, SEC-3100, SEC-3150) in your environment running affected firmware versions 1.0.0 through 1.9.0. Within 7 days, begin staging and testing firmware 1.9.1 in a non-production environment to validate compatibility. Complete rollout of firmware 1.9.1 to all affected devices within 30 days, sequencing updates to minimize impact on charging availability.

CHARX SEC CVE-2026-44093

Q: What is the CVSS score of CVE-2026-44093?

CVE-2026-44093 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51028 HIGH

OS Command Injection (CWE-78)

2026-07-30 info@cert.vde.com

GHSA-g352-vvxj-jq8m

Privilege Escalation Command Injection

8.5

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local command injection needing an existing low-privileged account (AV:L, PR:L), no user interaction, and root execution gives full C/I/A impact with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:37 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.5

DescriptionCVE.org

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

AnalysisAI

Local privilege escalation in Phoenix Contact CHARX SEC electric-vehicle charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) lets a low-privileged local user inject OS commands via the user-application init-script and execute them as root, yielding full device compromise. The flaw was reported by CERT@VDE and is fixed in firmware 1.9.1; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. EPSS data was not provided, so widespread automated exploitation cannot be confirmed.

Technical ContextAI

The affected devices are CHARX SEC AC EV charging controllers, embedded Linux-based industrial charge controllers used in EV charging infrastructure. The root cause is CWE-78 (Improper Neutralization of Special Elements in an OS Command, i.e. OS command injection): an init-script responsible for launching user-applications incorporates attacker-influenced input into a command executed with root privileges without adequate sanitization. Because init/startup scripts typically run in the root context during service launch, injected shell metacharacters or command fragments are executed with elevated privileges. The affected product families identified in the ENISA EUVD are CHARX SEC-3000, SEC-3050, SEC-3100 and SEC-3150 across firmware 1.0.0 up to (but not including) 1.9.1.

RemediationAI

Vendor-released patch: update affected CHARX SEC-3000, SEC-3050, SEC-3100 and SEC-3150 controllers to firmware version 1.9.1 or later, as provided by Phoenix Contact and documented in advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Until the update can be applied, reduce exposure by restricting who can obtain local or low-privileged access to the controllers: limit and audit local user accounts, enforce strong authentication and least privilege on any shell or management interface, and place the charging controllers on a segmented, access-controlled network so that only trusted maintenance hosts can reach management functions - the trade-off is added operational friction for legitimate on-site technicians. Because the vulnerability lives in a root-run init-script, avoid granting untrusted users any ability to modify user-application configuration or startup parameters.