Which versions of Phoenix Contact CHARX are affected by CVE-2026-44094?

Phoenix Contact CHARX SEC EV charging controller firmware (versions 1.0.0-1.9.1) contains an insecure fallback mechanism allowing remote unauthenticated attackers to force boot into an alternate…. A patch is available.

How to fix or mitigate CVE-2026-44094?

Within 24 hours, inventory all Phoenix Contact CHARX SEC devices (SEC-3000, SEC-3050, SEC-3100, SEC-3150 models) running firmware versions 1.0.0-1.9.1 and assess network exposure; isolate any internet-facing instances if patching cannot occur immediately. Within 7 days, apply the vendor-released patch to all affected devices and verify successful firmware update. Within 30 days, implement network segmentation to restrict administrative and SSH access to CHARX SEC controllers and deploy logging and monitoring for device boot events and login attempts.

Phoenix Contact CHARX CVE-2026-44094

Q: What is the CVSS score of CVE-2026-44094?

CVE-2026-44094 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51029 HIGH

Not Failing Securely ('Failing Open') (CWE-636)

2026-07-30 info@cert.vde.com

GHSA-vqrq-f9p4-xrm2

Information Disclosure

8.3

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but requires forcing the fallback condition (AC:H); unprivileged 'user-app' access gives low C/I, while charging interruption drives A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:36 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.3

DescriptionCVE.org

An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.

AnalysisAI

Insecure firmware-fallback in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150, versions 1.0.0 up to 1.9.1) lets a remote unauthenticated attacker force the device to boot an alternate firmware partition that ships with an insecure configuration and default credentials, yielding SSH access as the unprivileged 'user-app' account and allowing charging to be interrupted. The issue was reported by CERT@VDE (VDE-2026-008 / EUVD-2026-51029) and carries a CVSS 4.0 base score of 8.3, driven by high availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected devices are CHARX SEC series charging controllers used to manage AC EV charging stations. The root cause is CWE-636 (Not Failing Securely / 'Failing Open'): the firmware update and recovery mechanism includes a fallback partition that is intended for recovery but is provisioned with a hardened-less, insecure default configuration - including default credentials that enable SSH login as the low-privilege 'user-app' user. Because an attacker can remotely trigger the fallback to this partition, a security mechanism (the primary hardened firmware) degrades to an insecure state rather than failing closed. Per the EUVD/NVD CPE data the flaw affects CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 across firmware 1.0.0 through versions below 1.9.1.

RemediationAI

Vendor-released patch: upgrade all affected CHARX SEC-3000/3050/3100/3150 controllers to firmware version 1.9.1 or later, which is available from the vendor per advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Until patching is possible, restrict network access to the charger's management and SSH interfaces by placing devices on an isolated management VLAN or behind a firewall so that the fallback-triggering network path is not reachable by untrusted parties (trade-off: legitimate remote management must be tunneled or whitelisted); where feasible, disable or block external SSH access to prevent login via the 'user-app' default credentials (trade-off: loss of remote shell administration). Because the default credentials live in the fallback firmware image, changing runtime credentials on the primary partition does not fully mitigate - patching to 1.9.1 is the only reliable fix.