CHARX SEC CVE-2026-44104

The exploitable condition is the basemodule firmware update process itself, which accepts an image validated only by a CRC32 checksum with no cryptographic signature check - an attacker needs network reachability to that update interface and the ability to compute a valid CRC32 (trivial). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction and no special configuration are required against default deployments. The primary limiting factor is exposure of the firmware-update/management interface: exploitation requires reaching that endpoint over the network, so devices isolated on segmented OT networks are far harder to reach, and the target must be running affected firmware in the 1.0.0-1.9.0 range.

All signals point to genuine high priority. The vendor CVSS 4.0 base score is 9.3 (critical) with vector AV:N/AC:L/AT:N/PR:N/UI:N and high confidentiality, integrity and availability impact to the vulnerable system, indicating remote, unauthenticated, low-complexity exploitation against default configurations with no user interaction. The outcome - arbitrary firmware execution - is the maximal technical impact for an embedded device. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation yet; likewise no public POC was supplied, so this should not be treated as weaponized. The residual limiting factor is network reachability: exploitation requires the attacker to reach the device's firmware-update interface, which in well-segmented OT/charging networks may not be exposed to the public internet. Net: a real, patch-now issue whose realistic exposure depends heavily on network segmentation.

An attacker with network access to a CHARX SEC charging controller crafts a malicious basemodule firmware image, appends a correctly computed CRC32 checksum, and submits it through the firmware-update interface without needing any credentials. The device accepts and flashes the image, giving the attacker persistent, full control of the controller. No public POC has been identified, but the low attack complexity makes independent exploit development straightforward.