EUVD-2026-51041
GHSA-hc4q-m2pq-frr6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privileges required to read logs; high availability impact from charging interruption; low C and I bounded by limited user-app account scope.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
2DescriptionCVE.org
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.
AnalysisAI
Credential exposure in Phoenix Contact CHARX SEC EV charging controllers allows a low-privileged local attacker who can read log files to extract plaintext credentials for the built-in 'user-app' account and subsequently authenticate via SSH. Affected are all CHARX SEC-3000, 3050, 3100, and 3150 units running firmware versions 1.0.0 through 1.9.0. Successful exploitation can interrupt active EV charging sessions, constituting a high availability impact in operational charging infrastructure. No public exploit or active exploitation has been identified at time of analysis.
Technical ContextAI
CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: the firmware writes authentication credentials for the local 'user-app' system account into log files in recoverable plaintext or a recoverable form. The CHARX SEC product family (CPE inferred from EUVD affected versions: CHARX SEC-3000, SEC-3050, SEC-3100, SEC-3150) are dedicated EV charging controllers manufactured by Phoenix Contact, running embedded Linux with SSH enabled. The 'user-app' account is a limited, application-level OS account, but its SSH access is sufficient to interact with charging control processes. The CVSS 4.0 AT:P metric confirms that a specific attack prerequisite - access to the log storage location - must be met, distinguishing this from a trivially exploitable flaw.
RemediationAI
The primary remediation is to upgrade all affected CHARX SEC devices (3000, 3050, 3100, 3150) to firmware version 1.9.1 or later, which is confirmed available from the vendor per CERT VDE advisory VDE-2026-008 at https://www.certvde.com/en/advisories/VDE-2026-008/. Until patching is possible, restrict read access to system log files so that only privileged administrative accounts can read them - on embedded Linux this typically means auditing and tightening file permissions on log directories (e.g., /var/log). Additionally, disable SSH access for the 'user-app' account at the OS level (e.g., via AllowUsers or DenyUsers in /etc/ssh/sshd_config) if the account does not require remote login for normal operation; note this may affect management tooling that relies on that account. Physical access controls to the devices reduce the attacker's ability to reach local storage. These compensating controls are stopgaps - firmware upgrade to 1.9.1 is the definitive fix.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today