EUVD-2026-51032
GHSA-873j-vp5v-78x9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects mandatory operator credentials; A:L added over vendor's conservative rating because description explicitly states resource exhaustion may cause Denial-of-Service.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
2DescriptionCVE.org
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.
AnalysisAI
Unrestricted file upload in Phoenix Contact CHARX SEC series EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150 running firmware 1.0.0-1.9.0) allows a low-privileged remote attacker holding 'operator' credentials to push arbitrary files through the REST API endpoint designated for firmware updates. Successful exploitation results in persistent storage of attacker-controlled content on the device filesystem and, through repeated or oversized uploads, potential resource exhaustion leading to Denial-of-Service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch to firmware 1.9.1 is available per CERT VDE advisory VDE-2026-008.
Technical ContextAI
The CHARX SEC series are Phoenix Contact embedded AC EV charge controllers - purpose-built Linux-based devices managing EV charging sessions in commercial and industrial deployments. The REST API exposed by these devices includes an endpoint for firmware update uploads; this endpoint fails to enforce any meaningful restriction on uploaded file types, instantiating CWE-434 (Unrestricted Upload of File with Dangerous Type). The 'operator' role is a built-in, low-privilege account tier with authenticated network access to the REST interface - above guest but below administrator. Because file type and content validation is absent, the endpoint accepts arbitrary payloads beyond legitimate firmware images, and the device stores them persistently. All four hardware variants (SEC-3000, SEC-3050, SEC-3100, SEC-3150) across the 1.0.0-1.9.0 firmware range share this code path, as confirmed by the ENISA EUVD entry EUVD-2026-51032.
RemediationAI
The primary and recommended fix is to upgrade all affected CHARX SEC devices to firmware version 1.9.1 or later, which addresses the unrestricted file upload vulnerability per the vendor patch noted in the CERT VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-008/. Prior to patching, implement network-layer controls to restrict access to the CHARX SEC REST API to trusted hosts only - use firewall ACLs or VLAN segmentation to ensure the firmware update endpoint is unreachable from untrusted networks or general corporate LAN segments; note this does not protect against insider or compromised-internal-host scenarios. Additionally, audit and minimize the number of accounts with 'operator' privileges, enforce strong unique passwords for all operator accounts, and disable any default or shared operator credentials. Be aware that network segmentation carries an operational trade-off in environments where remote management of chargers is required - coordinate with OT network architects before restricting REST API reachability.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today