Phoenix Contact CHARX CVE-2026-7849

The description specifies improper neutralization of special elements allowing injection of a command into the system configuration that is then executed as root; the concrete prerequisite is network reachability to the configuration interface of an affected CHARX SEC controller running a version below 1.9.1. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required - exploitation works against a network-reachable device out of the box. The primary limiting factor is exposure: these are OT charging appliances that are typically deployed on segmented or isolated networks, so an attacker must first reach the device's management network to exploit it.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction and yielding full compromise as root - the exploitation-friendly end of the spectrum. No EPSS score, KEV status, or SSVC decision data was provided, so probabilistic exploitation likelihood and confirmed active-exploitation signals cannot be evaluated; the absence of a KEV listing means there is no evidence of active exploitation, and no POC was referenced. The main mitigating real-world factor is exposure: CHARX controllers are OT/EV-charging appliances that should not be directly internet-facing, so realized risk depends heavily on network segmentation. Where these devices are reachable, this should be treated as critical.

An attacker with network reachability to an unpatched CHARX SEC controller sends a crafted request containing shell metacharacters to the configuration interface, injecting a command that the device writes into and executes as part of its system configuration. Because the process runs as root, the injected command executes with full privileges, letting the attacker take over the charging controller - no authentication, credentials, or user interaction are required. No public POC was identified in the provided data.