Description
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHOENIX CONTACT | CHARX SEC-3000 | < 1.6.3 | 1.6.3 |
| PHOENIX CONTACT | CHARX SEC-3050 | < 1.6.3 | 1.6.3 |
| PHOENIX CONTACT | CHARX SEC-3100 | < 1.6.3 | 1.6.3 |
| PHOENIX CONTACT | CHARX SEC-3150 | < 1.6.3 | 1.6.3 |
Advisories 1
- VDE-2024-022 Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers CERT@VDE · Aug 27, 2025