Skip to content
OpenAdvisories
High · 8.8 CVE-2025-25271 EUVD-2025-20401GHSA-q8vp-977j-9pjv

OCPP Backend Configuration via Insecure Defaults

Published Jul 8, 2025 · Updated Jul 22, 2025 · Assigned by CERTVDE

Vendor: Phoenix Contact Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150 Category: ICS / OT

Description

An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.

Affected products

VendorProductAffectedFixed
Phoenix Contact CHARX SEC-3150 0.0.0 – < 1.7.3 1.7.3
Phoenix Contact CHARX SEC-3100 0.0.0 – < 1.7.3 1.7.3
Phoenix Contact CHARX SEC-3050 0.0.0 – < 1.7.3 1.7.3
Phoenix Contact CHARX SEC-3000 0.0.0 – < 1.7.3 1.7.3

Advisories 1

References