Which versions of CHARX SEC are affected by CVE-2026-44101?

Phoenix Contact CHARX SEC EV charging controllers contain a critical vulnerability allowing unauthenticated attackers to hijack charging operations and steal customer data.. A patch is available.

How to fix or mitigate CVE-2026-44101?

Within 24 hours: Identify all CHARX SEC EV charging controllers running firmware below version 1.9.1 and assess their network connectivity. Within 7 days: Apply firmware patch version 1.9.1 or later to all affected controllers via Phoenix Contact's update mechanism. Within 30 days: Verify patching completion across all installations, implement network access controls to restrict OCPP management interface exposure, and audit backend configuration logs for unauthorized changes during the vulnerability exposure window.

CHARX SEC CVE-2026-44101

Q: What is the CVSS score of CVE-2026-44101?

CVE-2026-44101 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-51036 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-30 info@cert.vde.com

GHSA-xjm9-rr2c-vpq2

Authentication Bypass

9.3

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated remote reconfiguration function (PR:N/AV:N/AC:L/UI:N) yields high confidentiality, integrity and availability impact; scope unchanged as impact stays within the charger.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:34 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.

AnalysisAI

Backend reconfiguration in Phoenix Contact CHARX SEC EV charging controllers is possible without any authentication because the CHARX OCPP Agent service exposes management functionality to unauthenticated remote callers (CWE-306). Any network-adjacent attacker can repoint the charger's OCPP backend connection, causing denial-of-service and disclosure of confidential data routed to an attacker-controlled backend. No public exploit is identified at time of analysis, but the CVSS 4.0 base score of 9.3 and full unauthenticated network reach make this a high priority for operators of affected charge controllers (firmware below 1.9.1).

Technical ContextAI

The affected component is the OCPP (Open Charge Point Protocol) Agent running on Phoenix Contact CHARX SEC charge controllers, which are DIN-rail EV charging control modules that broker communication between the local charging hardware and a remote Charging Station Management System (CSMS) backend over OCPP. The root cause is CWE-306 (Missing Authentication for a Critical Function): the service that manages the backend connection parameters accepts reconfiguration requests without verifying the caller's identity. Because the backend URL/credentials define where charging session data and control traffic flow, an unauthenticated party who can change them effectively becomes a man-in-the-middle or can sever the charger from its legitimate management system. CPE strings were not provided, but EUVD enumerates the affected models as CHARX SEC-3000, SEC-3050, SEC-3100 and SEC-3150.

RemediationAI

Vendor-released patch: update affected CHARX SEC-3000/3050/3100/3150 controllers to firmware 1.9.1 or later, which is the first release outside the vulnerable 1.0.0-<1.9.1 range, per CERT@VDE advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Until firmware can be applied, restrict network reachability of the OCPP Agent management interface: place chargers on a dedicated management VLAN or behind a firewall that permits access only from the trusted CSMS backend and administrative hosts, and block the OCPP Agent service port from all untrusted and internet-facing networks - the trade-off is that any legitimate remote management or backend re-provisioning must originate from within the permitted segment. Monitor chargers for unexpected changes to backend connection settings as a detective control, since the vulnerability offers no in-product authentication to rely on.