EUVD-2026-51044
GHSA-4mmh-4692-xw3f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network command injection with no user interaction (AV:N/AC:L/PR:N/UI:N); code runs as root yielding full C/I/A impact; scope unchanged as it affects the same OS.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
AnalysisAI
Remote code execution in Phoenix Contact CHARX SEC series EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through before 1.9.1) allows an unauthenticated network attacker to inject commands into the system configuration that are subsequently executed with root privileges. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact on the device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The description specifies improper neutralization of special elements allowing injection of a command into the system configuration that is then executed as root; the concrete prerequisite is network reachability to the configuration interface of an affected CHARX SEC controller running a version below 1.9.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to an unpatched CHARX SEC controller sends a crafted request containing shell metacharacters to the configuration interface, injecting a command that the device writes into and executes as part of its system configuration. Because the process runs as root, the injected command executes with full privileges, letting the attacker take over the charging controller - no authentication, credentials, or user interaction are required. … |
| Remediation | Vendor-released patch: upgrade all affected CHARX SEC-3000/3050/3100/3150 devices to version 1.9.1 or later, which resolves the command injection; consult the CERT@VDE advisory VDE-2026-008 at https://www.certvde.com/en/advisories/VDE-2026-008/ for exact update procedures. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all deployed CHARX SEC controllers (models SEC-3000/3050/3100/3150), document current firmware versions, and network-isolate any systems running versions prior to 1.9.1 from untrusted networks if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today