EUVD-2026-51038
GHSA-jp46-h3g9-gpp8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access with no complexity; firmware replacement constitutes full integrity compromise of the charging module, warranting I:H.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
2DescriptionCVE.org
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.
AnalysisAI
Unauthenticated remote firmware injection in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, 3050, 3100, 3150) exposes all devices running firmware 1.0.0 through 1.9.0 to arbitrary firmware replacement on the internal charging module. The JupiCore service, responsible for firmware update delivery, performs no cryptographic integrity or authenticity verification before transmitting payloads to the charging module, making this exploitable by any network-reachable attacker with no credentials or user interaction. The vendor confirms a patch exists in firmware 1.9.1, and the vulnerability can be chained with CVE-2026-44104 for compounded impact; no public exploit identified at time of analysis.
Technical ContextAI
The affected devices are Phoenix Contact CHARX SEC-series wall-box and charging-controller appliances (SEC-3000, SEC-3050, SEC-3100, SEC-3150), used in EV charging infrastructure. The JupiCore service is the internal firmware management component that orchestrates firmware update delivery to the device's charging module. CWE-434 (Unrestricted Upload of File with Dangerous Type) is the root cause: JupiCore accepts and relays firmware payloads to the internal charging module without validating cryptographic signatures, hash digests, or any other authenticity mechanism. This is a classic firmware supply-chain attack surface internal to the device - the update channel itself becomes the exploitation path. The affected version range spans all firmware from 1.0.0 to below 1.9.1, confirming the flaw is foundational to the JupiCore architecture rather than an edge-case regression.
RemediationAI
Upgrade all affected CHARX SEC-3000, 3050, 3100, and 3150 devices to firmware version 1.9.1 or later, which is confirmed available from the vendor per the CERT VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-008/. Until patching is feasible, implement network-level controls to restrict access to the JupiCore firmware update service: place CHARX SEC devices on an isolated OT network segment accessible only from authorized update servers or engineering workstations, and deny all inbound firmware-update traffic from untrusted sources using firewall ACLs or VLAN segmentation. This compensating control reduces the attack surface but does not eliminate the underlying integrity verification flaw. Organizations should also evaluate exposure to CVE-2026-44104 concurrently, as the two vulnerabilities are documented as chainable.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today