Phoenix Contact CHARX SEC EUVD-2026-51031

Exploitation requires the attacker to already hold the local, low-privileged 'charx-web' account on the CHARX SEC device and to reach the udhcpc-driven command path that runs as root; per the CVSS vector (AV:L/PR:L/UI:N) this is local and authenticated with no user interaction. The limiting factors are the need for that pre-existing 'charx-web' foothold and local access to the device - it is not remotely exploitable by an unauthenticated network attacker against a default configuration - while the absence of any UI or high-privilege requirement means that once the foothold is held, escalation to root is low-complexity and reliable.

The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.5) describes a locally-exploitable but reliable path: no user interaction, low attack complexity, and only low existing privileges (the 'charx-web' account) needed to gain full confidentiality, integrity and availability impact as root. Because the attack vector is Local rather than Network, remote mass exploitation is not the concern; the realistic threat is any actor or chained web-facing flaw that first obtains the 'charx-web' foothold and then escalates to root. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or widespread exploitation - this is a high-severity, high-impact issue whose priority is driven by the criticality of the OT/EV-charging deployment rather than by observed exploitation. SSVC-style reading: exploitation is not currently observed, technical impact is total, but automatability is limited by the local-access precondition.

An attacker who has obtained the low-privileged 'charx-web' account - for example via a phished credential or a chained web-interface weakness - invokes the vulnerable udhcpc command path and injects shell metacharacters that are executed by the root-context DHCP script. The result is arbitrary command execution as root and full compromise of the charging controller. No public exploit code was identified, and the local, low-complexity vector makes reliable exploitation straightforward once the foothold exists.