CVE-2026-44096 Details
Description
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
A privilege escalation vulnerability has been identified in the udhcpc component of Phoenix Contact CHARX SEC-3xxx EV charging controllers, specifically in the SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models, all running firmware prior to 1.9.1. This vulnerability allows a local user to execute arbitrary commands with root privileges, potentially leading to a complete system compromise.
Users are advised to update affected devices to firmware version 1.9.1, which addresses this vulnerability. The updated firmware will be available by August 12, 2026.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.certvde.com/en/advisories/VDE-2026-008/ | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Phoenix Contact CHARX SEC-3000 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3050 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3100 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3150 | < FW 1.9.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |