CVE-2026-44103

MEDIUM

JupiCore does not perform validation of firmware

Title source: cna

Description

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.

References (1)

Core 1

Core References

https://www.certvde.com/en/advisories/VDE-2026-008/

Scores

CVSS v3 5.3

EPSS 0.0024

EPSS Percentile 14.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-434

Status published

Products (4)

Phoenix Contact/CHARX SEC-3000 1.0.0 - 1.9.1

Phoenix Contact/CHARX SEC-3050 1.0.0 - 1.9.1

Phoenix Contact/CHARX SEC-3100 1.0.0 - 1.9.1

Phoenix Contact/CHARX SEC-3150 1.0.0 - 1.9.1

Published Jul 30, 2026

Tracked Since Jul 30, 2026