Summary
Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered.
Details
Impact
The vulnerabilities can lead to a total loss of confidentiality, integrity and availability of the devices.
Mitigation
Affected charging controllers are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.
Remediation
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes vulnerabilities CVE-2025-24005 and CVE-2025-24006. The vulnerabilities CVE-2025-24002, CVE-2025-24003 and CVE-2025-24004 affect the Eichrecht functionality in FW <=1.6.5 and in the meantime there is no vendor fix planned for these issues.
Product Description
CHARX SEC EVSE charging controller
Vulnerabilities 5
-
High 8.2
MQTT OOB Write Vulnerability in EichrechtAgents of German EV Charging Stations
An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.
-
High 7.8
Local Privilege Escalation via Vulnerable SSH Script
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.
-
High 7.8
Privilege Escalation via Insecure SSH Permissions
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.
-
Medium 5.3
MQTT DoS Vulnerability in German EV Charging Stations
An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.
-
Medium 5.2
USB-C Buffer Overflow via Display Interface in EV Charging Stations
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watc…
Revision history
-
#1
Initial Revision
References
-
PCSA-2025-00001
https://phoenixcontact.com/psirt
-
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact/
-
VDE-2025-014: Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers - HTML
https://certvde.com/en/advisories/VDE-2025-014
-
Phoenix Contact application note
https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf