Skip to content
OpenAdvisories
High VDE-2025-074 1 CVE

Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

Published Oct 14, 2025 · Updated Oct 15, 2025 · Revision 2

Vendor: Phoenix Contact Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150

Summary

A vulnerability in the firmware of CHARX SEC-3xxx charging controllers has been discovered.

Details

Impact
The vulnerability can lead to a total loss of confidentiality, integrity and availability of the devices.

Mitigation
Affected charging controllers are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.

Remediation
Phoenix Contact strongly recommends to upgrade to firmware version 1.7.4 which fixes vulnerability CVE-2025-41699

Product Description
CHARX SEC EVSE charging controller

Vulnerabilities 1

  • High 8.8
    CVE-2025-41699

    Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

    An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of gene…

    Phoenix Contact CHARX SEC-3150 CHARX SEC-3050 CHARX SEC-3100 ICS / OT

Revision history

  1. #1.1.0

    Updated the reporting credits, corrected reference token for one product, fixed typo in Document notes

  2. #1.0.0

    Initial Revision

References