EUVD-2026-51029
GHSA-vqrq-f9p4-xrm2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N) but requires forcing the fallback condition (AC:H); unprivileged 'user-app' access gives low C/I, while charging interruption drives A:H.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.
AnalysisAI
Insecure firmware-fallback in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150, versions 1.0.0 up to 1.9.1) lets a remote unauthenticated attacker force the device to boot an alternate firmware partition that ships with an insecure configuration and default credentials, yielding SSH access as the unprivileged 'user-app' account and allowing charging to be interrupted. The issue was reported by CERT@VDE (VDE-2026-008 / EUVD-2026-51029) and carries a CVSS 4.0 base score of 8.3, driven by high availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to a CHARX SEC-3000/3050/3100/3150 controller running firmware below 1.9.1 and the ability to force the device into its firmware fallback (recovery) partition, which boots with the insecure default configuration and default credentials for the 'user-app' SSH account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H) indicates network-reachable, unauthenticated exploitation with low attack complexity but an attack requirement present (AT:P), meaning a specific precondition or repeated attempt is needed to force the fallback - this is what tempers the otherwise high score of 8.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to an exposed CHARX SEC charger repeatedly triggers the firmware fallback condition, forcing the controller to boot its insecure recovery partition. They then SSH in using the built-in default credentials for the 'user-app' account and, from that foothold, interrupt or deny charging operations. … |
| Remediation | Vendor-released patch: upgrade all affected CHARX SEC-3000/3050/3100/3150 controllers to firmware version 1.9.1 or later, which is available from the vendor per advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Phoenix Contact CHARX SEC devices (SEC-3000, SEC-3050, SEC-3100, SEC-3150 models) running firmware versions 1.0.0-1.9.1 and assess network exposure; isolate any internet-facing instances if patching cannot occur immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today