CS
Product
CHARX SEC-3150
51
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 29Medium 9Low 0
Watch
Add CHARX SEC-3150 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7849 | 9.8 | Jul 30 | Command Injection in SCM (idledisconnect parameter) Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44108 | 9.8 | Jul 30 | Firewall bypass during shutdown Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44104 | 9.8 | Jul 30 | ControllerAgent does not perform validation of firmware Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44101 | 9.8 | Jul 30 | OCPP reconfiguration vulnerability Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44090 | 9.8 | Jul 30 | Missing authentication for MQTT Broker Affected: 1.0.0 before 1.9.1 |
| CVE-2025-25270 | 9.8 | Jul 8 | Remote Code Execution via Unauthenticated Configuration Manipulation Affected: 0.0.0 before 1.7.3 |
| CVE-2024-6788 | 9.8 | Aug 13 | Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password Affected: before 1.6.3 |
| CVE-2024-26001 | 9.8 | Mar 12 | PHOENIX CONTACT: Out of bounds write only memory access Affected: through 1.5.0 |
| CVE-2024-25996 | 9.8 | Mar 12 | PHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series Affected: through 1.5.0 |
| CVE-2024-25995 | 9.8 | Mar 12 | PHOENIX CONTACT: Remote code execution in CHARX Series Affected: through 1.5.0 |
| CVE-2026-44100 | 9.4 | Jul 30 | JupiCore charging point reconfiguration without auth Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44092 | 9.1 | Jul 30 | Missing input validation / stripping of CRLF characters in SystemConfigManager Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44091 | 9.1 | Jul 30 | Creation of a new configuration by posting a malicious ID to MQTT Affected: 1.0.0 before 1.9.1 |
| CVE-2025-41699 | 8.8 | Oct 14 | Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers Affected: 0.0.0 before 1.7.4 |
| CVE-2025-25271 | 8.8 | Jul 8 | OCPP Backend Configuration via Insecure Defaults Affected: 0.0.0 before 1.7.3 |
| CVE-2025-25268 | 8.8 | Jul 8 | Unauthenticated Configuration Access via Exposed API Endpoint Affected: 0.0.0 before 1.7.3 |
| CVE-2024-11497 | 8.8 | Jan 14 | Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation Affected: before 1.7.0 |
| CVE-2024-26288 | 8.7 | Mar 12 | PHOENIX CONTACT: Lack of SSL support in CHARX Series Affected: through 1.5.0 |
| CVE-2026-44098 | 8.6 | Jul 30 | OS Command Injection in OCPP Agent via charge_box_id Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44094 | 8.6 | Jul 30 | Fallback to second RAUC slot with default credentials Affected: 1.0.0 before 1.9.1 |
| CVE-2025-25269 | 8.4 | Jul 8 | Local Privilege Escalation via Unauthenticated Command Injection Affected: 0.0.0 before 1.7.3 |
| CVE-2025-24003 | 8.2 | Jul 8 | MQTT OOB Write Vulnerability in EichrechtAgents of German EV Charging Stations Affected: 0.0.0 through 1.6.5 |
| CVE-2026-44106 | 7.8 | Jul 30 | Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44099 | 7.8 | Jul 30 | Local Privilege Escalation via pppd password injection Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44096 | 7.8 | Jul 30 | udhcpc Privilege Escalation Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44095 | 7.8 | Jul 30 | Local Privilege Escalation via Network scripts Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44093 | 7.8 | Jul 30 | Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script Affected: 1.0.0 before 1.9.1 |
| CVE-2025-24006 | 7.8 | Jul 8 | Privilege Escalation via Insecure SSH Permissions Affected: 0.0.0 before 1.7.3 |
| CVE-2025-24005 | 7.8 | Jul 8 | Local Privilege Escalation via Vulnerable SSH Script Affected: 0.0.0 before 1.7.3 |
| CVE-2024-28137 | 7.8 | May 14 | PHOENIX CONTACT: privilege escalation due to a TOCTOU vulnerability in the CHARX Series Affected: through 1.5.1 |
| CVE-2024-28136 | 7.8 | May 14 | PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service Affected: through 1.5.1 |
| CVE-2024-28133 | 7.8 | May 14 | PHOENIX CONTACT: Privilege escalation in CHARX Series Affected: through 1.5.1 |
| CVE-2024-26002 | 7.8 | Mar 12 | PHOENIX CONTACT: File ownership manipulation in CHARX Series Affected: through 1.5.0 |
| CVE-2024-25999 | 7.8 | Mar 12 | PHOENIX CONTACT: Privilege escalation in the OCPP agent service Affected: through 1.5.0 |
| CVE-2026-44107 | 7.5 | Jul 30 | Exposed Reboot via Modbus Affected: 1.0.0 before 1.9.1 |
| CVE-2026-41032 | 7.5 | Jun 3 | Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers Affected: 1.0.0 before 1.9.0 |
| CVE-2024-26004 | 7.5 | Mar 12 | PHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX Series Affected: through 1.5.0 |
| CVE-2024-26003 | 7.5 | Mar 12 | PHOENIX CONTACT: DoS of the control agent in CHARX Series Affected: through 1.5.0 |
| CVE-2024-26000 | 7.5 | Mar 12 | PHOENIX CONTACT: Out of bounds read only memory access Affected: through 1.5.0 |
| CVE-2024-25998 | 7.3 | Mar 12 | PHOENIX CONTACT: Command injection in the OCPP Service Affected: through 1.5.0 |
| CVE-2026-44097 | 7.1 | Jul 30 | File Upload vulnerability Affected: 1.0.0 before 1.9.1 |
| CVE-2024-28134 | 7.0 | May 14 | PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series Affected: through 1.5.1 |
| CVE-2026-44105 | 6.6 | Jul 30 | Cleartext password in logs Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44103 | 5.3 | Jul 30 | JupiCore does not perform validation of firmware Affected: 1.0.0 before 1.9.1 |
| CVE-2026-44102 | 5.3 | Jul 30 | OCPP Firmware download is not properly locked Affected: 1.0.0 before 1.9.1 |
| CVE-2025-24002 | 5.3 | Jul 8 | MQTT DoS Vulnerability in German EV Charging Stations Affected: 0.0.0 through 1.6.5 |
| CVE-2024-25997 | 5.3 | Mar 12 | PHOENIX CONTACT: Log injection in CHARX Series Affected: through 1.5.0 |
| CVE-2024-25994 | 5.3 | Mar 12 | PHOENIX CONTACT: Unintended script file upload in CHARX Series Affected: through 1.5.0 |
| CVE-2025-24004 | 5.2 | Jul 8 | USB-C Buffer Overflow via Display Interface in EV Charging Stations Affected: 0.0.0 through 1.6.5 |
| CVE-2024-28135 | 5.0 | May 14 | PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series Affected: through 1.5.1 |