CVE-2026-44095 Details
Description
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
A privilege escalation vulnerability has been identified in the firmware of Phoenix Contact CHARX SEC-3xxx EV charging controllers, specifically in the SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models, all running firmware prior to 1.9.1. This vulnerability allows a low-privileged local user to execute arbitrary commands as root, leading to full system compromise.
Users are advised to update affected devices to firmware version 1.9.1, which addresses this vulnerability. The updated firmware will be available by August 12, 2026.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.certvde.com/en/advisories/VDE-2026-008/ | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Phoenix Contact CHARX SEC-3000 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3050 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3100 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3150 | < FW 1.9.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |