Which versions of Phoenix Contact CHARX are affected by CVE-2026-44095?

Phoenix Contact EV charging controllers (CHARX SEC-3000/3050/3100/3150 models running firmware before 1.9.1) are vulnerable to privilege escalation attacks that allow any local account holder to…. A patch is available.

How to fix or mitigate CVE-2026-44095?

Immediately (within 24 hours): Identify all Phoenix Contact CHARX SEC-3000/3050/3100/3150 charging controllers and document current firmware versions. Within 7 days: Develop and test a firmware upgrade plan for deployment to version 1.9.1 or later in a non-production environment, including rollback procedures and validation steps. Within 30 days: Execute full production firmware upgrades to 1.9.1 or later across all affected controllers, prioritizing those with the highest access levels and network exposure.

Phoenix Contact CHARX CVE-2026-44095

Q: What is the CVSS score of CVE-2026-44095?

CVE-2026-44095 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51030 HIGH

OS Command Injection (CWE-78)

2026-07-30 info@cert.vde.com

GHSA-mw8x-6p3j-j9fh

Privilege Escalation Command Injection

8.5

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Requires an existing low-privileged local account to abuse a root-run config script, so AV:L and PR:L with AC:L and no UI; command execution as root gives full C/I/A loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:36 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.5

DescriptionCVE.org

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

AnalysisAI

Local privilege escalation in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers (firmware 1.0.0 through versions before 1.9.1) lets a low-privileged local user inject OS commands through a network-configuration script and gain root, yielding full device compromise. The flaw is a classic CWE-78 command injection reachable by any authenticated local account (CVSS 4.0 8.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected devices are Phoenix Contact CHARX SEC series charge controllers - embedded Linux-based control units for AC/DC electric-vehicle charging infrastructure. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where a helper script responsible for network configuration passes attacker-influenced input into a shell context without proper sanitization. Because the script runs with elevated (root) privileges, injected shell metacharacters or arguments are executed as root. The EUVD-listed CPE-equivalent products are CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 across firmware 1.0.0 up to (not including) 1.9.1.

RemediationAI

Vendor-released patch: update affected CHARX SEC-3000/3050/3100/3150 controllers to firmware 1.9.1 or later, which is the first fixed release per the CERT@VDE advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Until the update can be applied, reduce exposure by restricting who can obtain a local/authenticated session on the controller - limit and audit local user accounts, disable or tightly control any remote-shell or remote-management access to the device, and place the charging controllers on a segmented management network reachable only by trusted operators; the trade-off is reduced remote administrability and added operational friction. Because the flaw lives in a root-privileged network-configuration script, avoid delegating network-configuration functions to low-privileged users where the platform allows it. Confirm the exact fixed version and any model-specific notes against the vendor advisory before deployment.