Skip to content
OpenAdvisories
High · 7.3 CVE-2024-25998 EUVD-2024-23294GHSA-fcx8-38mg-gr6r

PHOENIX CONTACT: Command injection in the OCPP Service

Published Mar 12, 2024 · Updated Jan 24, 2025 · Assigned by CERTVDE

Vendor: Phoenix Contact Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150 Category: ICS / OT

Description

An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation.

Affected products

VendorProductAffectedFixed
PHOENIX CONTACT CHARX SEC-3000 ≤ 1.5.0 —
PHOENIX CONTACT CHARX SEC-3050 ≤ 1.5.0 —
PHOENIX CONTACT CHARX SEC-3100 ≤ 1.5.0 —
PHOENIX CONTACT CHARX SEC-3150 ≤ 1.5.0 —

Advisories 1

References