CVE-2026-44098: Phoenix Contact Charx Sec-3000

High severity, CVSS 8.6. EPSS: 1.7% chance of exploitation in the next 30 days.

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

Affected products

• Phoenix Contact Charx Sec-3000: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3050: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3100: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3150: from 1.0.0, before 1.9.1 (fixed in 1.9.1)

Published 2026-07-30. Last modified 2026-07-30.