CHARX SEC EUVD-2026-51028

Exploitation requires local access to the device and an existing low-privileged account (CVSS PR:L, AV:L) - it is not remotely reachable without a prior foothold and needs no user interaction (UI:N). The specific prerequisite is the ability to influence the input consumed by the init-script for user-applications, which runs as root; the vulnerable code path is that startup/init script for user-applications. Limiting factors: the attacker must already be authenticated as a low-privileged local user on an affected CHARX SEC-3000/3050/3100/3150 running firmware between 1.0.0 and 1.9.0, so devices with tightly controlled local access and no untrusted low-privilege accounts are substantially harder to exploit.

The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.5 High) indicates a local-only attack requiring existing low-level privileges but no user interaction, with high confidentiality, integrity and availability impact on the vulnerable system and no scope change to other systems. The local attack vector and PR:L requirement materially limit real-world risk versus a network-exploitable flaw: an attacker must already have some foothold (a low-privileged shell or account) on the controller. Against that, the impact is maximal (root/full compromise) and complexity is low, so any low-privileged access is trivially escalated. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation - this reads as a genuine but access-gated privilege-escalation issue rather than a mass-exploited remote bug. Missing signals: EPSS probability and SSVC automatable/exploitation status were not supplied and cannot be inferred.

An attacker who has already obtained a low-privileged local account or shell on a CHARX SEC charging controller (for example via a weak service account or on-site maintenance access) supplies crafted input to the user-application init-script. Because the script builds and runs a command as root without sanitizing that input, the injected command executes with root privileges, giving the attacker full control of the charger. No public exploit code has been identified, but the low attack complexity makes exploitation straightforward once local access exists.