Which versions of Phoenix Contact CHARX are affected by CVE-2026-44106?

Phoenix Contact CHARX SEC EV charging controllers (models SEC-3000/3050/3100/3150, versions 1.0.0-1.9.1) contain a local privilege escalation vulnerability enabling low-privileged users to execute…. A patch is available.

How to fix or mitigate CVE-2026-44106?

Within 24 hours, identify all deployed Phoenix Contact CHARX SEC controllers and determine which run vulnerable versions 1.0.0-1.9.1. Within 7 days, test vendor patch version 1.9.1 in a staging environment to verify charging operations, connectivity, and safety functions remain fully operational, then develop production deployment procedures with rollback plans. Complete production deployment within 30 days, prioritizing controllers in high-availability and safety-critical locations; document patch versions and deployment timestamps for compliance records and monitor post-patch system performance.

Phoenix Contact CHARX CVE-2026-44106

Q: What is the CVSS score of CVE-2026-44106?

CVE-2026-44106 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51040 HIGH

OS Command Injection (CWE-78)

2026-07-30 info@cert.vde.com

GHSA-xhmp-rwc3-2j56

Privilege Escalation Command Injection

8.5

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local, low-complexity escalation from an existing unprivileged account (AV:L, AC:L, PR:L) to root, giving full high impact to C/I/A with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:33 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.5

DescriptionCVE.org

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

AnalysisAI

Local privilege escalation in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 up to 1.9.1) allows a low-privileged local user to execute arbitrary commands as root through a vulnerable init-script for user-applications, yielding full system compromise. Reported by CERT@VDE and classified as OS command injection (CWE-78), the flaw carries a CVSS 4.0 base score of 8.5 (local vector, low privileges required). A vendor patch (1.9.1) is available; no public exploit identified at time of analysis.

Technical ContextAI

The affected devices are the CHARX SEC series of AC EV charging controllers from Phoenix Contact, embedded Linux-based control units used to manage electric-vehicle charge points. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), located in the init-script that launches user-applications: the script incorporates attacker-influenceable input into a command executed with root privileges without proper sanitization. Because init/startup scripts on such embedded controllers run as root during service launch, injected commands inherit root, converting a low-privilege foothold into complete control of the device firmware and its charging-control functions.

RemediationAI

Vendor-released patch: upgrade affected CHARX SEC-3000/3050/3100/3150 devices to firmware version 1.9.1 or later, which is the first fixed release per the version range (1.0.0 <1.9.1); follow the guidance in Phoenix Contact/CERT@VDE advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Until patching is possible, restrict who can obtain any local or low-privileged account on the controller: limit and audit shell/service access, disable or lock unused local accounts, and place the chargers on an isolated management network segment so a remote attacker cannot easily gain the local foothold this bug requires - the trade-off is reduced remote administration convenience but no impact on charging operation. Because exploitation depends on local access, tightening access control and network segmentation directly reduces exposure while the firmware update is staged.