Phoenix Contact's CHARX SEC series charge controllers ship a ModbusServer that trusts MQTT input without validation, letting an unauthenticated remote attacker corrupt integrity and availability at CVSS 9.1.
What Is It
CVE-2026-44092 is a CRLF/protocol injection flaw (CWE-93) in the ModbusServer application running on Phoenix Contact CHARX SEC charge controllers. The application fetches input from MQTT and does not validate it before use. An unauthenticated remote attacker can inject malicious input through that path, leading to integrity and availability loss.
The CVE was published 2026-07-30 by CERT@VDE and is currently in "Received" status in NVD.
Why It Matters
The flaw carries a CVSS 3.1 base score of 9.1 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Network attack vector, low complexity, no privileges, no user interaction: as scored, the vulnerable service offers little resistance to an attacker who already has network reach to it, though deployment-specific network segmentation may still stand in the way. Impact is HIGH on both integrity and availability, with no confidentiality impact.
CERT@VDE also assigned a CVSS 4.0 score of 8.8 (HIGH), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N.
Because the flaw affects Modbus, the control-plane protocol for these devices, the HIGH integrity rating suggests an attacker could influence device state rather than merely crash a process, though the published advisory data does not detail how far that influence extends.
What's Vulnerable
Phoenix Contact CHARX SEC controllers, versions 1.0.0 up to (but not including) 1.9.1:
- CHARX SEC-3000
- CHARX SEC-3050
- CHARX SEC-3100
- CHARX SEC-3150
All four products share the same affected version range. Versions outside that range are listed as unaffected.
Patch Status
The affected version data indicates the fix lands in 1.9.1: versions below 1.9.1 are flagged affected, 1.9.1 and later are not. Operators running CHARX SEC-3000/3050/3100/3150 should update to 1.9.1 or later and consult the CERT@VDE advisory for vendor guidance.
CVE-2026-44092 does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing, so there is no KEV-mandated remediation deadline at this time. Absence from KEV is not evidence that exploitation is not occurring; it indicates only that CISA has not catalogued confirmed in-the-wild use as of this writing. Exploit maturity in the CVSS 4.0 metric is NOT_DEFINED.
Sources
- NVD, CVE-2026-44092: https://nvd.nist.gov/vuln/detail/CVE-2026-44092
- CERT@VDE Advisory VDE-2026-008: https://www.certvde.com/en/advisories/VDE-2026-008/
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog