Phoenix Contact CHARX CVE-2026-44095

Exploitation requires an existing low-privileged authenticated local account on the device (CVSS PR:L, AV:L) and access to the vulnerable network-configuration script that runs with root privileges; the attacker supplies crafted input to that script to inject OS commands. What limits exploitation: the attacker must already have local, authenticated access to the controller (no remote or unauthenticated path per the AV:L/PR:L vector), and only firmware versions 1.0.0 through those before 1.9.1 on CHARX SEC-3000/3050/3100/3150 are affected. No user interaction is required (UI:N).

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) describes a locally exploitable, low-complexity flaw requiring existing low-level authentication but no user interaction, with total loss of confidentiality, integrity, and availability of the device - a coherent and self-consistent signal set for a local privilege-escalation bug. No EPSS score, POC reference, or KEV entry was provided, so real-world exploitation likelihood cannot be quantified; the local attack vector inherently limits mass, remote exploitation. The practical risk is elevated for any deployment where multiple users, remote-management sessions, or lower-trust processes can reach a local shell on the controller, since escalation to root is then straightforward; for physically isolated single-operator installs the exposure is lower. There is no conflict between the CVSS vector and the description - both point to local, authenticated privilege escalation.

An attacker who already holds a low-privileged local account on a CHARX SEC controller (for example, a limited operator login or a foothold from another lower-trust process) invokes the network-configuration script with crafted input containing shell metacharacters. The script executes the injected commands as root, giving the attacker a root shell and complete control of the charging controller. No public exploit code was identified, but the low attack complexity makes weaponization straightforward for someone with local access.