A missing cryptographic signature check in the CHARX SEC charging controller firmware update process lets an unauthenticated remote attacker install modified firmware and fully compromise the device.
What Is It
The firmware update process for the basemodule of the Phoenix Contact CHARX charging controller validates only a CRC32 checksum. It performs no cryptographic signature verification. CRC32 is an error-detection mechanism, not an authenticity control; an attacker can freely modify firmware and recompute a matching checksum.
The result is an improper verification of cryptographic signature flaw (CWE-347) that allows an unauthenticated remote attacker to install modified firmware, resulting in full system compromise.
It carries a CVSS v3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 9.3 (CRITICAL). The CVE was published 2026-07-30 and coordinated through CERT@VDE.
Why It Matters
Every exploitability metric is at its worst value: network attack vector, low attack complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability impacts are all rated High.
Because the attack replaces firmware rather than exploiting a runtime bug, an attacker gains persistent control of the controller; attacker-supplied code survives reboots and sits below the level most operational monitoring inspects. These are EV charging controllers, so compromised devices sit at the boundary between public-facing infrastructure and the operator's network.
The supplied source material contains no CISA KEV entry for this CVE, and CVSS v4.0 exploit maturity is NOT_DEFINED. There is no evidence of active exploitation in the data available here.
What's Vulnerable
Phoenix Contact CHARX SEC controllers, firmware versions 1.0.0 up to (but not including) 1.9.1:
- CHARX SEC-3000
- CHARX SEC-3050
- CHARX SEC-3100
- CHARX SEC-3150
All other versions are listed as unaffected.
Patch Status
The affected version range ends at 1.9.1, indicating firmware 1.9.1 or later is the fixed release. Operators should upgrade affected CHARX SEC-3000/3050/3100/3150 units to 1.9.1 or newer.
No CISA KEV entry, and therefore no federally mandated remediation deadline, was present in the supplied data. Consult the CERT@VDE advisory below for vendor remediation guidance.
Sources
- NVD, CVE-2026-44104: https://nvd.nist.gov/vuln/detail/CVE-2026-44104
- CERT@VDE Advisory VDE-2026-008: https://www.certvde.com/en/advisories/VDE-2026-008/