Which versions of Phoenix Contact CHARX are affected by CVE-2026-44099?

Phoenix Contact CHARX SEC electric-vehicle charging controllers (versions prior to 1.9.1) contain a privilege escalation vulnerability enabling low-privileged users to gain full administrative…. A patch is available.

How to fix or mitigate CVE-2026-44099?

Within 24 hours, inventory all deployed Phoenix Contact CHARX SEC models (SEC-3000/3050/3100/3150) and document current firmware versions; flag instances running versions 1.0.0 through 1.9.0 as critical. Within 7 days, prepare and deploy firmware upgrade to version 1.9.1 or later across all affected devices, prioritizing production charging stations and coordinating maintenance windows to minimize service disruption. Within 30 days, complete full rollout across all installations, verify upgrade completion through firmware version validation, and document remediation activities in change management systems.

Phoenix Contact CHARX CVE-2026-44099

Q: What is the CVSS score of CVE-2026-44099?

CVE-2026-44099 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51034 HIGH

OS Command Injection (CWE-78)

2026-07-30 info@cert.vde.com

GHSA-6wx6-cj8g-h6jg

Privilege Escalation Command Injection

8.5

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local low-privileged account required (AV:L, PR:L), no user interaction and simple injection (AC:L, UI:N), root command execution gives full C/I/A loss on the device.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:35 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.5

DescriptionCVE.org

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

AnalysisAI

Privilege escalation in Phoenix Contact CHARX SEC electric-vehicle charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 up to but excluding 1.9.1) lets a low-privileged local user inject and run arbitrary OS commands as root through the device's system configuration handling, yielding full compromise of the charging controller. The flaw is a CWE-78 OS command injection reported by CERT@VDE (advisory VDE-2026-008), and a vendor patch is available in version 1.9.1. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected devices are Phoenix Contact CHARX SEC series EV charging station controllers, embedded Linux-based operational-technology appliances that manage AC/DC charging sessions. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection): a system-configuration interface passes attacker-influenced input into a shell or command context without adequate sanitization, so an authenticated low-privilege account can break out of intended bounds and have the underlying OS execute injected commands with root privileges. The CVSS 4.0 vector (AV:L) confirms the attack surface is reached locally on the device rather than directly across the network.

RemediationAI

Apply the vendor fix by upgrading affected CHARX SEC-3000/3050/3100/3150 controllers to firmware version 1.9.1 or later (Vendor-released patch: 1.9.1), as published in CERT@VDE advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Until patching is possible, reduce exposure by tightly restricting who can obtain local or low-privileged access to the controllers: limit and audit device accounts, place the charging controllers on an isolated OT/management network segment, and disable or restrict access to any local configuration or management interface for non-administrative users - trade-off being that constraining configuration access may hinder legitimate operational or maintenance workflows. Because exploitation requires an existing low-privilege account, minimizing and monitoring those accounts is the most effective compensating control while scheduling the firmware upgrade.