Phoenix Contact CHARX CVE-2026-44106

Exploitation requires an existing low-privileged local account on the affected CHARX SEC device (CVSS PR:L, AV:L) and the ability to reach the vulnerable init-script for user-applications; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific prerequisite is local access plus interaction with the user-application initialization script that runs as root. Limiting factors: the attacker cannot exploit this purely remotely - they must first hold or obtain a local unprivileged account or console/physical access - and only firmware versions 1.0.0 through those below 1.9.1 on SEC-3000/3050/3100/3150 hardware are affected, so patched or non-CHARX-SEC devices are out of scope.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a local attack requiring an existing low-privileged account but no user interaction and low complexity, with high impact to confidentiality, integrity, and availability of the vulnerable system and no scope change to other systems - consistent with a classic local root escalation. The 8.5 score is high, driven by total device compromise rather than by remote reachability; the local vector and PR:L requirement meaningfully limit real-world risk to attackers who already have some access (an unprivileged shell, a compromised service account, or physical/console access). No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is identified - so there is no signal of active or automatable exploitation. Net: a genuine escalation-to-root priority for anyone whose threat model includes untrusted local users or a chained remote foothold on these chargers, but not an internet-facing, mass-exploitable issue.

An attacker who has already obtained a low-privileged local account on a CHARX SEC charger - for example via a compromised service, weak local credentials, or on-site access - invokes or influences the vulnerable user-application init-script to inject an OS command. The script runs the injected command as root, giving the attacker full control of the charging controller. No public proof-of-concept is identified at time of analysis, and the low attack complexity means the escalation is straightforward once local access exists.