Critical VDE-2025-019 4 CVEs

Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

Published Jul 8, 2025 · Updated Jul 22, 2025 · Revision 2

Vendor: Phoenix Contact Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150

Summary

Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered.

**Update Version 1.1.0:** Updated the reporting credits for CVE-2025-25271.

Details

Impact
The vulnerabilities can lead to a total loss of confidentiality, integrity and availability of the devices.

Mitigation
Affected charging controllers are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.

Remediation
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.3 which fixes these vulnerabilities.

Product Description
CHARX EVSE charging controller

Vulnerabilities 4

Critical 9.8

CVE-2025-25270

Remote Code Execution via Unauthenticated Configuration Manipulation

An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.

Phoenix Contact CHARX SEC-3000 CHARX SEC-3150 CHARX SEC-3050 ICS / OT

Jul 8, 2025
High 8.8

CVE-2025-25268

Unauthenticated Configuration Access via Exposed API Endpoint

An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.

Phoenix Contact CHARX SEC-3150 CHARX SEC-3050 CHARX SEC-3100 ICS / OT

Jul 8, 2025
High 8.8

CVE-2025-25271

OCPP Backend Configuration via Insecure Defaults

An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.

Phoenix Contact CHARX SEC-3100 CHARX SEC-3000 CHARX SEC-3150 ICS / OT

Jul 8, 2025
High 8.4

CVE-2025-25269

Local Privilege Escalation via Unauthenticated Command Injection

An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.

Phoenix Contact CHARX SEC-3150 CHARX SEC-3050 CHARX SEC-3100 ICS / OT

Jul 8, 2025

Revision history

2025-07-22 #1.1.0
Updated the reporting credits for CVE-2025-25271.
2025-07-08 #1.0.0
Initial Revision

References

PCSA-2025-00002
https://phoenixcontact.com/psirt
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact/
VDE-2025-019: Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers - HTML
https://certvde.com/en/advisories/VDE-2025-019
Phoenix Contact application note
https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf