High VDE-2026-060 1 CVE

Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers

Published Jun 3, 2026 · Updated Jun 3, 2026 · Revision 2

Vendor: Phoenix Contact Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150

Summary

VDE-2026-060: A unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers has been discovered.

Details

Impact
The vulnerability can lead to restricted information being disclosed to an unauthenticated attacker.

Mitigation
Affected charging controllers are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.

Remediation
Phoenix Contact recommends to upgrade to firmware version 1.9.0 which fixes this vulnerability.

Product Description
CHARX EVSE charging controller

Vulnerabilities 1

High 7.5

CVE-2026-41032

Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.

Phoenix Contact CHARX SEC-3150 CHARX SEC-3050 CHARX SEC-3100 ICS / OT

Jun 3, 2026

Revision history

2026-06-03 #1.0.1
added "Firmware" to the textual description of the relationships.
2026-06-03 #1.0.0
Initial revision

References

PCSA-2026-00007
https://phoenixcontact.com/psirt
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact/
VDE-2026-060: Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers - HTML
https://certvde.com/en/advisories/VDE-2026-060
Phoenix Contact application note
https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf