CVE-2026-44103: Phoenix Contact Charx Sec-3000

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.

Affected products

• Phoenix Contact Charx Sec-3000: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3050: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3100: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3150: from 1.0.0, before 1.9.1 (fixed in 1.9.1)

Published 2026-07-30. Last modified 2026-07-30.