CVE-2024-26005— PHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX Series
Quick assessment
Affected
PHOENIX CONTACT CHARX SEC-3000
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PHOENIX CONTACT CHARX SEC是德国菲尼克斯电气（PHOENIX CONTACT）公司的一系列 AC 充电控制器。 PHOENIX CONTACT CHARX SEC存在安全漏洞，该漏洞源于存在拒绝服务（DOS）漏洞。攻击者可利用该漏洞在服务重启期间获得服务级别权限。受影响的产品和版本：CHARX SEC-3000 1.5.0及之前版本， CHARX SEC-3050 1.5.0及之前版本，CHARX SEC-3100 1.5.0及之前版本， CHARX SEC-3150 1.5.0及
Possible ATT&CK Techniques 1 AI
T1136 · Create Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-26005
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX Series
Source: CVE Program / CVE List V5
Vulnerability Description
An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
清理环节不完整
Source: CVE Program / CVE List V5
Vulnerability Title
PHOENIX CONTACT CHARX SEC 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHOENIX CONTACT CHARX SEC是德国菲尼克斯电气（PHOENIX CONTACT）公司的一系列 AC 充电控制器。 PHOENIX CONTACT CHARX SEC存在安全漏洞，该漏洞源于存在拒绝服务（DOS）漏洞。攻击者可利用该漏洞在服务重启期间获得服务级别权限。受影响的产品和版本：CHARX SEC-3000 1.5.0及之前版本， CHARX SEC-3050 1.5.0及之前版本，CHARX SEC-3100 1.5.0及之前版本， CHARX SEC-3150 1.5.0及
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PHOENIX CONTACT | CHARX SEC-3000 | 0 ~ 1.5.0 | - |
|
| PHOENIX CONTACT | CHARX SEC-3050 | 0 ~ 1.5.0 | - |
|
| PHOENIX CONTACT | CHARX SEC-3100 | 0 ~ 1.5.0 | - |
|
| PHOENIX CONTACT | CHARX SEC-3150 | 0 ~ 1.5.0 | - |
|
II. Public POCs for CVE-2024-26005
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-26005
请登录查看更多情报信息。
Other References for CVE-2024-26005 (1)
Same Patch Batch · PHOENIX CONTACT · 2024-03-12 · 13 CVEs total
| CVE-2024-25995 | 9.8 CRITICAL | PHOENIX CONTACT: Remote code execution in CHARX Series |
| CVE-2024-26288 | 8.7 HIGH | PHOENIX CONTACT: Lack of SSL support in CHARX Series |
| CVE-2024-25999 | 8.4 HIGH | PHOENIX CONTACT: Privilege escalation in the OCPP agent service |
| CVE-2024-26002 | 7.8 HIGH | PHOENIX CONTACT: File ownership manipulation in CHARX Series |
| CVE-2024-26003 | 7.5 HIGH | PHOENIX CONTACT: DoS of the control agent in CHARX Series |
| CVE-2024-26004 | 7.5 HIGH | PHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX |
| CVE-2024-26001 | 7.4 HIGH | PHOENIX CONTACT: Out of bounds write only memory access |
| CVE-2024-25998 | 7.3 HIGH | PHOENIX CONTACT: Command injection in the OCPP Service |
| CVE-2024-26000 | 5.9 MEDIUM | PHOENIX CONTACT: Out of bounds read only memory access |
| CVE-2024-25994 | 5.3 MEDIUM | PHOENIX CONTACT: Unintended script file upload in CHARX Series |
| CVE-2024-25996 | 5.3 MEDIUM | PHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series |
| CVE-2024-25997 | 5.3 MEDIUM | PHOENIX CONTACT: Log injection in CHARX Series |
IV. Related Vulnerabilities
Same product: CHARX SEC-3000
-
CVE-2024-11497
Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable -
CVE-2024-6788
Phoenix Contact: update feature from CHARX controller can be -
CVE-2024-28137
PHOENIX CONTACT: privilege escalation due to a TOCTOU vulne -
CVE-2024-28136
PHOENIX CONTACT: command injection gains root privileges usi -
CVE-2024-28135
PHOENIX CONTACT: command injection vulnerability in the API
Same weakness: CWE-459
-
CVE-2026-104427
Zebra before 6.1.0 Chain Stall via Stale parent_error_map En -
CVE-2026-104421
Zebra before 6.2.1 Block Download Denial of Service via Know -
CVE-2026-95326
Chrome 154.0.8037.57前蓝牙资源清理不当漏洞 -
CVE-2026-95303
Chrome 154.0.8037.57前SmartCard清理不全漏洞 -
CVE-2026-101100
ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterT
V. Comments for CVE-2024-26005
No comments yet