Phoenix Contact Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with Phoenix Contact products.

Products

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

SQL injection

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

CWE-89Aug 12, 2026
CVSS5.3v4.0EPSS0.163%PoCs0SignalsSTIX

Unauthenticated Denial of Service

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.

CWE-770Aug 12, 2026
CVSS8.7v4.0EPSS0.386%PoCs0SignalsSTIX

Unauthenticated Buffer Overflow in PROFINET Service

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

CWE-120Aug 12, 2026
CVSS9.3v4.0EPSS0.586%PoCs0SignalsSTIX

Command Injection in SCM (idledisconnect parameter)

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.

CWE-77Jul 30, 2026
CVSS9.3v4.0EPSS0.419%PoCs0SignalsSTIX

Firewall bypass during shutdown

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.

CWE-696Jul 30, 2026
CVSS9.3v4.0EPSS0.462%PoCs0SignalsSTIX

Exposed Reboot via Modbus

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.

CWE-749Jul 30, 2026
CVSS8.7v4.0EPSS0.309%PoCs0SignalsSTIX

Cleartext password in logs

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.

CWE-532Jul 30, 2026
CVSS5.8v4.0EPSS0.094%PoCs0SignalsSTIX

Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

CWE-78Jul 30, 2026
CVSS8.5v4.0EPSS0.232%PoCs0SignalsSTIX

ControllerAgent does not perform validation of firmware

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

CWE-347Jul 30, 2026
CVSS9.3v4.0EPSS0.241%PoCs0SignalsSTIX

JupiCore does not perform validation of firmware

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.

CWE-434Jul 30, 2026
CVSS6.9v4.0EPSS0.236%PoCs0SignalsSTIX

OCPP Firmware download is not properly locked

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.

CWE-362Jul 30, 2026
CVSS6.9v4.0EPSS0.209%PoCs0SignalsSTIX

OCPP reconfiguration vulnerability

Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.

CWE-306Jul 30, 2026
CVSS9.3v4.0EPSS0.401%PoCs0SignalsSTIX

JupiCore charging point reconfiguration without auth

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.

CWE-306Jul 30, 2026
CVSS8.8v4.0EPSS0.277%PoCs0SignalsSTIX

Local Privilege Escalation via pppd password injection

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

CWE-78Jul 30, 2026
CVSS8.5v4.0EPSS0.232%PoCs0SignalsSTIX

OS Command Injection in OCPP Agent via charge_box_id

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

CWE-78Jul 30, 2026
CVSS8.8v4.0EPSS1.37%PoCs0SignalsSTIX

File Upload vulnerability

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.

CWE-434Jul 30, 2026
CVSS5.3v4.0EPSS0.244%PoCs0SignalsSTIX

udhcpc Privilege Escalation

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.

CWE-78Jul 30, 2026
CVSS8.5v4.0EPSS0.232%PoCs0SignalsSTIX

Local Privilege Escalation via Network scripts

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

CWE-78Jul 30, 2026
CVSS8.5v4.0EPSS0.232%PoCs0SignalsSTIX

Fallback to second RAUC slot with default credentials

An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.

CWE-636Jul 30, 2026
CVSS8.3v4.0EPSS0.258%PoCs0SignalsSTIX

Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

CWE-78Jul 30, 2026
CVSS8.5v4.0EPSS0.232%PoCs0SignalsSTIX

Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

CWE-93Jul 30, 2026
CVSS8.8v4.0EPSS0.38%PoCs0SignalsSTIX

Creation of a new configuration by posting a malicious ID to MQTT

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.

CWE-501Jul 30, 2026
CVSS8.8v4.0EPSS0.327%PoCs0SignalsSTIX

Missing authentication for MQTT Broker

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.

CWE-306Jul 30, 2026
CVSS9.3v4.0EPSS0.401%PoCs0SignalsSTIX

Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.

CWE-200Jun 3, 2026
CVSS7.5v3.1EPSS0.26%PoCs0SignalsSTIX

Insufficient Verification of Data Authenticity

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.

CWE-347May 27, 2026
CVSS8.7v4.0EPSS0.218%PoCs0SignalsSTIX