Which versions of Phoenix Contact CHARX are affected by EUVD-2026-51043?

Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150 running versions 1.0.0-1.9.0) contain a critical vulnerability enabling remote unauthenticated attackers to gain complete…. A patch is available.

How to fix or mitigate EUVD-2026-51043?

Within 24 hours, perform inventory of all deployed Phoenix Contact CHARX SEC controllers (models SEC-3000/3050/3100/3150) running firmware versions 1.0.0-1.9.0 and implement network-level access controls to restrict external connectivity to affected devices; simultaneously obtain the fixed firmware from Phoenix Contact referencing vendor advisory VDE-2026-008. Within 7 days, deploy the vendor-released patch to all identified affected controllers and verify successful installation across the entire deployed base through direct device validation. Within 30 days, complete comprehensive attestation that all vulnerable instances have been remediated, establish enhanced logging and monitoring for exploitation attempts against these device models, and conduct network flow review to determine if unauthorized access occurred during the vulnerability exposure window.

Phoenix Contact CHARX EUVD-2026-51043

Q: What is the CVSS score of EUVD-2026-51043?

EUVD-2026-51043 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-44108 CRITICAL

Incorrect Behavior Order (CWE-696)

2026-07-30 info@cert.vde.com

GHSA-hj6x-rh93-r6v7

Information Disclosure

9.3

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network, unauthenticated, no UI, and full compromise justify C/I/A:H and PR:N/UI:N, but exploitation depends on catching the transient shutdown window, so AC:H rather than AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:32 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.

AnalysisAI

Full system compromise of Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) is possible because an incorrect script execution order tears down the firewall too early during system shutdown, briefly exposing internal-only services to the network. During this transient window a remote unauthenticated attacker can reach services that are normally firewalled off and gain complete control of the device. No public exploit identified at time of analysis, but the flaw is vendor-confirmed (CERT@VDE / advisory VDE-2026-008) and carries a CVSS 4.0 base score of 9.3.

Technical ContextAI

The affected devices are Phoenix Contact CHARX SEC series charge controllers - embedded Linux-based controllers that manage AC/DC electric-vehicle charging stations and expose management and charging-protocol services. The root cause is CWE-696 (Incorrect Behavior Order): during the shutdown sequence the init/service scripts that stop the firewall run before the scripts that stop the internal network services, rather than after them. As a result there is an ordering gap in which the packet-filtering rules that normally confine services to localhost or a management interface are already gone while those services are still listening, allowing them to be reached from the external network. CPE-level identification is limited to the four EUVD product entries (CHARX SEC-3000, SEC-3050, SEC-3100, SEC-3150); no formal NVD CPE strings were provided.

RemediationAI

Vendor-released patch: upgrade all affected CHARX SEC-3000/3050/3100/3150 controllers to firmware version 1.9.1 or later, which corrects the shutdown script ordering; follow the procedure in the vendor advisory at https://www.certvde.com/en/advisories/VDE-2026-008/. Until the update can be applied, reduce exposure of the transient window by isolating the controllers on a dedicated management VLAN and using upstream network filtering (an external firewall or ACLs) so the internal services are never reachable from untrusted networks even if the on-device firewall drops early - the trade-off is added network-segmentation effort and possible impact to legitimate remote management. Additionally, minimize uncontrolled reboots/shutdowns and, where feasible, perform shutdowns only while the device is already network-isolated, since the exposure only occurs during shutdown; note this operational control does not fix the underlying flaw and should not be treated as a permanent substitute for the firmware update.