Description
An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHOENIX CONTACT | CHARX SEC-3000 | ≤ 1.5.0 | — |
| PHOENIX CONTACT | CHARX SEC-3050 | ≤ 1.5.0 | — |
| PHOENIX CONTACT | CHARX SEC-3100 | ≤ 1.5.0 | — |
| PHOENIX CONTACT | CHARX SEC-3150 | ≤ 1.5.0 | — |
Advisories 1
- VDE-2024-011 PHOENIX CONTACT: Multiple vulnerabilities in CHARX SEC charge controllers CERT@VDE · Mar 12, 2024