CVE-2026-44105 Details
Description
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.
A vulnerability exists in the CHARX SEC-3xxx series EV charging controllers, specifically models SEC-3000, SEC-3050, SEC-3100, and SEC-3150, all running firmware prior to 1.9.1. This vulnerability may expose the credentials of the local user 'user-app' in log files. A low-privileged local attacker with access to these logs could authenticate via SSH as 'user-app', potentially interrupting charging processes.
Users are advised to update to firmware version 1.9.1, which addresses this vulnerability. The updated firmware will be available by August 12, 2026.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.certvde.com/en/advisories/VDE-2026-008/ | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Phoenix Contact CHARX SEC-3000 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3050 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3100 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3150 | < FW 1.9.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |