Which versions of Phoenix Contact CHARX SEC are affected by CVE-2026-44096?

Phoenix Contact CHARX SEC electric vehicle charging controllers running firmware 1.0.0 through 1.9.0 contain a local privilege escalation vulnerability enabling complete device takeover.. A patch is available.

How to fix or mitigate CVE-2026-44096?

Within 24 hours, identify all deployed CHARX SEC-3000/3050/3100/3150 units running firmware 1.0.0 through 1.9.0 and isolate high-risk units from production if patching cannot be performed immediately. Within 7 days, deploy firmware version 1.9.1 to all affected devices, conducting pilot patching on non-critical units first to validate the update process. Within 30 days, complete patching of all CHARX SEC controllers to firmware 1.9.1 or later and verify successful deployment across the entire fleet.

Phoenix Contact CHARX SEC CVE-2026-44096

Q: What is the CVSS score of CVE-2026-44096?

CVE-2026-44096 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51031 HIGH

OS Command Injection (CWE-78)

2026-07-30 info@cert.vde.com

GHSA-rrvj-gc4g-ccjf

Privilege Escalation Command Injection

8.5

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Requires the local low-privileged charx-web account (AV:L, PR:L) with no user interaction and low complexity, yielding full root impact (C/I/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:35 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.5

DescriptionCVE.org

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.

AnalysisAI

Local privilege escalation in the Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, firmware 1.0.0 through 1.9.0) lets the low-privileged local account 'charx-web' inject and run arbitrary OS commands as root via the udhcpc DHCP client, yielding full device takeover. The flaw is a CWE-78 OS command injection reported by CERT@VDE, and a vendor patch (1.9.1) is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

udhcpc is BusyBox's lightweight DHCP client, commonly embedded in Linux-based appliances such as these charging controllers. It invokes a configuration script (typically /usr/share/udhcpc/default.script) on lease events and exports DHCP-supplied option values into the script's environment. When those values, or a wrapping helper, are passed unsanitized into a shell context, an actor able to influence them achieves OS command injection - the CWE-78 root cause class cited here. In this case the exposed 'charx-web' web/service account can reach that command-execution path and have commands run under root, the context udhcpc's scripts execute in. The affected CPE set covers the CHARX SEC-3000, SEC-3050, SEC-3100 and SEC-3150 hardware variants.

RemediationAI

Upgrade the affected CHARX SEC controllers to firmware version 1.9.1 or later, which is the vendor-released patch; consult the CERT@VDE advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/) for exact update packages and instructions per hardware model. Until the update can be applied, reduce exposure of the prerequisite 'charx-web' account by restricting and monitoring access to the device's web/management interface, placing the charging controllers on an isolated management VLAN, and limiting who can authenticate to that service - with the trade-off that these controls do not remove the underlying command-injection path and only shrink the population of actors who can reach it. Avoid exposing the management interface to untrusted networks, since a compromise of 'charx-web' is the pivot to root.