Which versions of Phoenix Contact CHARX are affected by EUVD-2026-51035?

Phoenix Contact CHARX SEC charging controllers (firmware 1.0.0-1.9.0) expose critical EV charging infrastructure to unauthenticated remote reconfiguration, allowing any network-connected attacker to…. A patch is available.

How to fix or mitigate EUVD-2026-51035?

Within 24 hours: Inventory all Phoenix Contact SEC-3000/3050/3100/3150 units and identify any running firmware versions 1.0.0 through 1.9.0; confirm network reachability and document baseline configuration. Within 7 days: Obtain the patched firmware from Phoenix Contact via the CERT@VDE advisory; no public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable given the missing authentication, so prioritize deployment planning and staging validation. Within 30 days: Complete firmware upgrade to version 1.9.1 or later across all affected charging controllers, with priority given to units on untrusted or user-accessible networks.

Phoenix Contact CHARX EUVD-2026-51035

Q: What is the CVSS score of EUVD-2026-51035?

EUVD-2026-51035 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-44100 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-30 info@cert.vde.com

GHSA-382g-wcph-26j3

Authentication Bypass

8.8

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Missing authentication on a network-reachable service gives AV:N/AC:L/PR:N/UI:N; reconfiguration/file tampering and DoS yield I:H/A:H, with only UID disclosure so C:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:34 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.8

DescriptionCVE.org

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.

AnalysisAI

Unauthenticated reconfiguration of Phoenix Contact CHARX SEC EV charging controllers is possible through the JupiCore service, which exposes charging-point management functions without any authentication (CWE-306). Remote attackers reachable on the network can rewrite charging-point configuration to disclose charging-point UIDs, tamper with files, and cause a Denial-of-Service against affected SEC-3000/3050/3100/3150 units running firmware 1.0.0 up to (but not including) 1.9.1. No public exploit identified at time of analysis, but the vendor (via CERT@VDE) has released a fixed firmware and the flaw is trivially exploitable given the missing authentication.

Technical ContextAI

The affected devices are Phoenix Contact CHARX SEC series charge controllers - the embedded controller hardware/firmware that manages AC/DC electric-vehicle charging stations, typically speaking OCPP to backend systems and coordinating charging points. The vulnerability sits in the CHARX JupiCore service, an internal management/control service that governs charging-point configuration. The root cause is CWE-306 (Missing Authentication for a Critical Function): JupiCore exposes configuration and control operations over the network without verifying the caller's identity, so any party who can reach the service inherits full reconfiguration privileges. Affected products are identified as CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 firmware from 1.0.0 up to but not including 1.9.1 (EUVD-2026-51035).

RemediationAI

Upgrade affected CHARX SEC-3000/3050/3100/3150 controllers to firmware 1.9.1 or later, which is the first version outside the vulnerable range (1.0.0 <1.9.1) and corresponds to the vendor-released patch referenced in CERT@VDE advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/); confirm the exact build number against that advisory before deployment. Until firmware can be applied, restrict network reachability of the JupiCore service by placing the controllers on an isolated management VLAN or behind a firewall that permits access only from trusted charge-management backends and operator hosts, and block untrusted access to the device's management ports - the trade-off is that any legitimate remote management or OCPP integration must be explicitly allowlisted, and mis-scoped rules could interrupt charging operations, so validate connectivity to the charging backend after locking down.