Which versions of CHARX SEC are affected by CVE-2026-44107?

Phoenix Contact's CHARX SEC EV charging controllers (models SEC-3000/3050/3100/3150) contain an unauthenticated remote denial-of-service vulnerability allowing attackers to force system reboots…. A patch is available.

How to fix or mitigate CVE-2026-44107?

Within 24 hours, identify all Phoenix Contact CHARX SEC charging controllers (SEC-3000/3050/3100/3150) running firmware versions 1.0.0 through 1.9.0, document their network exposure, and implement temporary network restrictions on the Modbus TCP port (default 502) where feasible. Within 7 days, upgrade all affected controllers to firmware version 1.9.1 or later per vendor guidance. Within 30 days, complete a full asset inventory of all charging infrastructure, validate patch application across all systems, and implement network segmentation or firewall policies to restrict Modbus port access to authorized management systems only.

CHARX SEC CVE-2026-44107

Q: What is the CVSS score of CVE-2026-44107?

CVE-2026-44107 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51042 HIGH

Exposed Dangerous Method or Function (CWE-749)

2026-07-30 info@cert.vde.com

GHSA-84gq-hw46-3cvp

Information Disclosure

8.7

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Reachable Modbus port allows unauthenticated remote reboot (AV:N/AC:L/PR:N/UI:N) with pure availability loss and no confidentiality or integrity impact (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:32 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.7

DescriptionCVE.org

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.

AnalysisAI

Denial-of-service in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, firmware 1.0.0 up to but not including 1.9.1) allows an unauthenticated network attacker to reboot the charging controller by sending a crafted Modbus TCP command to the CharxModbusServer. The attack requires no credentials or user interaction and, per the CVSS 4.0 vector, produces high availability impact with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity makes reliable disruption of charging service straightforward once the Modbus port is reachable.

Technical ContextAI

The affected component is CharxModbusServer, the Modbus TCP service embedded in the CHARX SEC charging-controller firmware used to manage EV charging sessions and integrate with building/energy-management systems. Modbus TCP (typically TCP/502) is a legacy industrial protocol with no built-in authentication, so any function it exposes is available to anyone who can reach the port. The root cause maps to CWE-749 (Exposed Dangerous Method or Function): a reboot/reset operation of the controller is reachable through the Modbus interface without any authorization gate, meaning a normal protocol interaction can force a full device restart rather than being restricted to trusted operators.

RemediationAI

Vendor-released patch: update affected CHARX SEC-3000/3050/3100/3150 controllers to firmware version 1.9.1 or later, which is the fixed release identified by the vendor advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Where immediate patching is not possible, the most effective compensating control is to disable the Modbus TCP functionality on controllers that do not require it, which closes the exposed reboot method entirely at the cost of losing Modbus-based energy/load management integration. If Modbus must remain enabled, restrict reachability of the CharxModbusServer listening port (commonly TCP/502) with firewall rules or network segmentation so it is accessible only from a trusted management VLAN or specific host addresses; the trade-off is that legitimate Modbus masters must be explicitly allowlisted, and misconfiguration could break automation. Avoid exposing the Modbus port to the internet or general OT/IT LAN under any circumstances.