Phoenix Contact CHARX CVE-2026-44099

Exploitation requires the attacker to already hold a low-privileged local account or session on the CHARX SEC device (CVSS PR:L, AV:L) and to reach the vulnerable system-configuration functionality where unsanitized input is passed to an OS command (CWE-78). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local low-privilege access exists the command injection is straightforward. The key limiting factors are the local attack vector - there is no direct remote/network path in the provided vector - and the requirement for prior authentication at low privilege; affected deployments are limited to CHARX SEC-3000/3050/3100/3150 firmware 1.0.0 through versions below 1.9.1.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.5 / High) describes an easy, reliable local attack requiring only an existing low-privilege foothold and no user interaction, with total loss of confidentiality, integrity, and availability once triggered. The limiting factor is AV:L combined with PR:L: an attacker must already hold a local low-privileged account or session on the charging controller, which meaningfully narrows opportunistic exploitation compared with a network-facing unauthenticated flaw. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so there is no evidence of active or automatable exploitation at this time; the practical risk is a privilege-escalation primitive that chains after some initial access rather than a standalone remote break-in. Note the input provides only a CVSS 4.0 vector and no EPSS/KEV data - real-world exploitation probability cannot be quantified from the available signals.

An attacker who has already gained a low-privileged local account on a CHARX SEC charging controller (for example via weak credentials, a lower-severity foothold, or physical/console access) submits crafted input to the system-configuration function, injecting shell metacharacters that the device executes as root. With root achieved, the attacker fully controls the charging controller - altering charging behavior, tampering with firmware, or pivoting into the connected OT network. No public POC was identified at time of analysis.