CVE-2025-41699

HIGH

Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-41699 has a selected CVSS score of 8.8 (high).

Description

An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code ('Code Injection').

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 14, 2025 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

CHARX SEC-3000

Browse Phoenix Contact / CHARX SEC-3000

Default status: unaffected

CVE List0.0.0 to < 1.7.4affected

CHARX SEC-3050

Browse Phoenix Contact / CHARX SEC-3050

Default status: unaffected

CVE List0.0.0 to < 1.7.4affected

CHARX SEC-3100

Browse Phoenix Contact / CHARX SEC-3100

Default status: unaffected

CVE List0.0.0 to < 1.7.4affected

CHARX SEC-3150

Browse Phoenix Contact / CHARX SEC-3150

Default status: unaffected

CVE List0.0.0 to < 1.7.4affected

References

2