CVE-2026-44097 Details
Description
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.
A vulnerability exists in the Phoenix Contact CHARX SEC-3xxx EV charging controllers, specifically in the SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models, all running firmware prior to 1.9.1. The issue allows low-privileged remote attackers with 'operator' access to upload arbitrary files through a REST endpoint meant for firmware updates. This unauthorized file upload leads to the persistent storage of attacker-controlled files on the device, with the potential to exhaust resources and cause a denial-of-service condition.
Users are advised to update affected devices to firmware version 1.9.1, which addresses this vulnerability. The updated firmware will be available by August 12, 2026. Check the download section of the product webpage for the fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.certvde.com/en/advisories/VDE-2026-008/ | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Phoenix Contact CHARX SEC-3000 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3050 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3100 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3150 | < FW 1.9.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |