Skip to content
OpenAdvisories
High · 8.4 CVE-2025-25269 EUVD-2025-20403GHSA-4435-w7hr-8qwm

Local Privilege Escalation via Unauthenticated Command Injection

Published Jul 8, 2025 · Updated Jul 8, 2025 · Assigned by CERTVDE

Vendor: Phoenix Contact Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150 Category: ICS / OT

Description

An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.

Affected products

VendorProductAffectedFixed
Phoenix Contact CHARX SEC-3150 0.0.0 – < 1.7.3 1.7.3
Phoenix Contact CHARX SEC-3100 0.0.0 – < 1.7.3 1.7.3
Phoenix Contact CHARX SEC-3050 0.0.0 – < 1.7.3 1.7.3
Phoenix Contact CHARX SEC-3000 0.0.0 – < 1.7.3 1.7.3

Advisories 1

References