Phoenix Contact CHARX EUVD-2026-51043

Exploitation requires the device to be in its shutdown (or reboot) sequence - the vulnerable window exists only while the firewall has already been torn down but internal services are still running, per the description. The attacker must have network reachability to the controller's interface during that window and targets services that are normally firewall-blocked from external access. Limiting factors: the window is transient and timing-dependent (a race condition the attacker cannot freely trigger unless they can also force a shutdown/reboot), and it only affects CHARX SEC-3000/3050/3100/3150 firmware 1.0.0-1.9.0; no authentication or user interaction is needed to connect once the window is open (CVSS PR:N/UI:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) rates this critical, implying trivially exploitable remote unauthenticated compromise. However, the description reveals a meaningful limiting factor the base vector understates: exploitation only works during the brief window while the device is shutting down, which is a race/timing condition the attacker cannot freely trigger. In my independent assessment this warrants higher attack complexity (AC:H / AT:P) than the vendor's AT:N. There is no EPSS score, no CISA KEV listing, and no evidence of a public POC or active exploitation in the provided data, so real-world urgency is driven by the criticality of the impact and the exposure of the device class (internet- or field-network-reachable chargers) rather than by observed exploitation. Net: a genuine high priority to patch given full-compromise impact and network reachability, but the timing dependency makes opportunistic mass exploitation less likely than the raw 9.3 suggests.

An attacker with network reachability to a CHARX SEC controller waits for or induces a device shutdown or reboot (e.g., during a maintenance cycle or power event) and, during the brief firewall-down window, connects to a normally-blocked internal service and leverages it to gain full control of the controller. Because the CVSS vector indicates network attack vector with no authentication or user interaction, the connection itself requires no credentials; the main obstacle is catching the shutdown timing window. No public exploit identified at time of analysis.