VDE-2024-070 — Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers

Summary

Improper file permission handling allows an authenticated low privileged user to gain root access.

Details

Impact
This vulnerability allows the authenticated user "user-app" to gain root rights (privilege escalation).

Mitigation
Phoenix Contact recommends operating network-capable devices in closed networks or
protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to General Recommendation.

Remediation
Phoenix Contact strongly recommends upgrading affected charge controllers to firmware
version 1.7.0 or higher which fixes this vulnerability.

Product Description
CHARX control modular AC are charging controllers for mode 3 electric vehicle charging.

Vulnerabilities 1

High 8.8

CVE-2024-11497

Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation

An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.

Phoenix Contact CHARX SEC-3150 CHARX SEC-3050 CHARX SEC-3100 ICS / OT

Jan 14, 2025

Revision history

2025-05-14 #3
Fix: added distribution
2025-02-12 #2
Fix: corrected self-reference, fixed version
2025-01-14 #1
initial revision

References

PCSA-2024/00022:
https://phoenixcontact.com/psirt
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact/
Phoenix Contact application note
https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf
VDE-2024-070: Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers - HTML
https://certvde.com/en/advisories/VDE-2024-070/