CVE-2026-44102: Phoenix Contact Charx Sec-3000

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.

Affected products

• Phoenix Contact Charx Sec-3000: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3050: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3100: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3150: from 1.0.0, before 1.9.1 (fixed in 1.9.1)

Published 2026-07-30. Last modified 2026-07-30.