Which versions of CHARX SEC are affected by CVE-2026-44104?

A critical vulnerability in Phoenix Contact CHARX EV charging controllers (models 3000/3050/3100/3150) permits unauthenticated remote firmware replacement, exposing charging infrastructure to full…. A patch is available.

How to fix or mitigate CVE-2026-44104?

Within 24 hours, identify and catalog all Phoenix Contact CHARX SEC-3000, 3050, 3100, and 3150 controllers in operation, documenting current firmware versions and network exposure. Within 7 days, deploy vendor patch v1.9.1 to all affected units, beginning with externally accessible devices and systems supporting critical charging operations. Within 30 days, conduct post-patch validation across all controllers, enable anomaly detection for unauthorized firmware modification attempts, and perform forensic review of system logs from the past 90 days to identify any unauthorized access or firmware manipulation events.

CHARX SEC CVE-2026-44104

Q: What is the CVSS score of CVE-2026-44104?

CVE-2026-44104 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51039 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-30 info@cert.vde.com

GHSA-fvfc-m52v-j2p2

Information Disclosure Jwt Attack

9.3

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated firmware upload with no user interaction (AV:N/AC:L/PR:N/UI:N); accepting an unsigned image yields full device takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:34 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

AnalysisAI

Unauthenticated firmware implantation in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers allows a remote attacker to push a modified firmware image to the basemodule because the update routine only checks a CRC32 checksum and performs no cryptographic signature verification (CWE-347). A successful upload yields full system compromise of the controller. No public exploit has been identified at time of analysis, but the flaw is network-reachable with no authentication and a vendor patch (v1.9.1) is available.

Technical ContextAI

The affected devices are CHARX SEC series AC electric-vehicle charging controllers, the embedded control units that manage charging sessions and communication in EV charging stations. The vulnerability lies in the basemodule firmware update process, which uses CRC32 - an error-detection checksum, not a security primitive - as its only integrity gate. CRC32 provides no protection against intentional tampering because an attacker can freely recompute a valid checksum for any modified image. The root cause maps to CWE-347 (Improper Verification of Cryptographic Signature): the update path lacks a signed-firmware trust chain (e.g. an asymmetric signature validated against a vendor public key held on-device), so any well-formed image with a correct CRC32 is accepted and executed.

RemediationAI

Upgrade the basemodule firmware to version 1.9.1 or later, which is the vendor-released patch that closes the CRC32-only update path; the fix is documented in CERT@VDE advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Until every affected CHARX SEC-3000/3050/3100/3150 unit is on 1.9.1, restrict network access to the controllers by placing them on an isolated OT/charging VLAN and blocking reachability of the firmware-update and management interface from untrusted networks and the internet (trade-off: this may complicate legitimate remote maintenance and OTA updates, which must then be performed from a controlled jump host). Additionally, monitor for and alert on unexpected firmware-upload attempts and logically restrict who can reach the update endpoint. These are compensating controls only - they reduce reachability but do not restore signature validation, so patching remains mandatory.