CVE-2026-44107 Details
Description
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.
A denial-of-service vulnerability has been identified in Phoenix Contact CHARX SEC-3xxx EV charging controllers, specifically in the SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models, all running firmware prior to 1.9.1. The vulnerability allows an unauthenticated attacker to remotely trigger a reboot of the charging controller by exploiting the Modbus TCP functionality. This issue arises when the Modbus server port is open, creating an opportunity for disruption.
Users are advised to update their devices to firmware version 1.9.1, which addresses this vulnerability. The updated firmware will be available by August 12, 2026.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.certvde.com/en/advisories/VDE-2026-008/ | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Phoenix Contact CHARX SEC-3000 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3050 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3100 | < FW 1.9.1 |
CPE
Remediation
| |
| Phoenix Contact CHARX SEC-3150 | < FW 1.9.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |