Is there a patch available for CVE-2026-44102?

Yes, a patch is available for CVE-2026-44102. Update the affected software to the latest version immediately.

CHARX SEC CVE-2026-44102

Q: What is the CVSS score of CVE-2026-44102?

CVE-2026-44102 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51037 MEDIUM

Race Condition (CWE-362)

2026-07-30 info@cert.vde.com

GHSA-qrwj-j5f7-cjgm

Information Disclosure Race Condition

6.9

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Network vector and unauthenticated per description; AC:H for race condition timing dependency; low integrity only, no confidentiality or availability impact per CVSS 4.0 VC:N/VA:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 09:01 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

DescriptionCVE.org

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.

AnalysisAI

Firmware update handling in Phoenix Contact CHARX SEC EV charging controllers (versions 1.0.0 through 1.8.x) exposes a race condition exploitable by unauthenticated remote attackers via the OCPP backend. By supplying an invalid firmware file, an attacker can cause the file to persist temporarily in accessible device storage during the flawed cleanup window before deletion, resulting in low-impact integrity interference with the firmware management process. No public exploit code and no CISA KEV entry have been identified; a vendor-released patch is confirmed at version 1.9.1.

Technical ContextAI

The affected products are Phoenix Contact CHARX SEC series EV charge controllers - CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, and CHARX SEC-3150 - which implement OCPP (Open Charge Point Protocol), the industry-standard protocol enabling communication between EV charging stations and a central management backend. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause: the firmware update workflow lacks adequate file-system locking during the post-download cleanup phase. When an invalid firmware file is pushed via OCPP, the device completes the download before the validation failure triggers cleanup; due to the missing lock, the file window remains briefly accessible - a classic TOCTOU (Time-of-Check Time-of-Use) pattern embedded in the device's firmware management subsystem.

RemediationAI

Upgrade all affected CHARX SEC devices (SEC-3000, SEC-3050, SEC-3100, and SEC-3150) to firmware version 1.9.1 or later, which is the vendor-confirmed fix per EUVD-2026-51037; details are at https://www.certvde.com/en/advisories/VDE-2026-008/. If immediate firmware update is operationally infeasible, restrict OCPP backend access to trusted internal management VLANs or VPN-tunneled networks via firewall ACLs, preventing unauthenticated external actors from issuing firmware update commands - note this is a compensating control and does not remediate the underlying race condition. Where the OCPP implementation supports it, enforce authentication at the charging network management layer to reduce the unauthenticated attack surface. Operators should also review whether OCPP backend ports are unnecessarily internet-exposed, as this is the highest-risk deployment posture.