Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-44102— OCPP Firmware download is not properly locked

Quick assessment

Affected

Phoenix Contact CHARX SEC-3150

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PHOENIX CONTACT CHARX SEC-3150是德国PHOENIX CONTACT公司的电动车充电站。 PHOENIX CONTACT CHARX SEC-3150 1.9.1之前版本存在竞争条件问题漏洞，该漏洞源于清理过程中锁定不当，可能导致未经身份验证的远程攻击者通过OCPP后端提供无效固件文件触发固件更新下载，造成文件短暂可访问。

CVSS 5.3 · Medium EPSS 0.34% · P27 Updated Jul 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

Vendor	Product	Version Range	Status
Phoenix Contact	CHARX SEC-3000	`1.0.0< 1.9.1`	affected
Phoenix Contact	CHARX SEC-3050	`1.0.0< 1.9.1`	affected
Phoenix Contact	CHARX SEC-3100	`1.0.0< 1.9.1`	affected
Phoenix Contact	CHARX SEC-3150	`1.0.0< 1.9.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-44102

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OCPP Firmware download is not properly locked

Source: CVE Program / CVE List V5

Vulnerability Description

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用共享资源的并发执行不恰当同步问题(竞争条件)

Source: CVE Program / CVE List V5

Vulnerability Title

PHOENIX CONTACT CHARX SEC-3150 竞争条件问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Phoenix Contact	CHARX SEC-3150	1.0.0 ~ 1.9.1	-
Phoenix Contact	CHARX SEC-3100	1.0.0 ~ 1.9.1	-
Phoenix Contact	CHARX SEC-3050	1.0.0 ~ 1.9.1	-
Phoenix Contact	CHARX SEC-3000	1.0.0 ~ 1.9.1	-

II. Public POCs for CVE-2026-44102

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-44102

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-44102 (1)

🔗 Phoenix Contact: Multiple vulnerabilities in the firmware of CHARX SEC3xxx charging controllers Read full article

https://www.cve.org/CVERecord?id=CVE-2026-44102

Same Patch Batch · Phoenix Contact · 2026-07-30 · 20 CVEs total

CVE-2026-44090	9.8 CRITICAL	Missing authentication for MQTT Broker
CVE-2026-44104	9.8 CRITICAL	ControllerAgent does not perform validation of firmware
CVE-2026-44101	9.8 CRITICAL	OCPP reconfiguration vulnerability
CVE-2026-44108	9.8 CRITICAL	Firewall bypass during shutdown
CVE-2026-7849	9.8 CRITICAL	Command Injection in SCM (idledisconnect parameter)
CVE-2026-44100	9.4 CRITICAL	JupiCore charging point reconfiguration without auth
CVE-2026-44092	9.1 CRITICAL	Missing input validation / stripping of CRLF characters in SystemConfigManager
CVE-2026-44091	9.1 CRITICAL	Creation of a new configuration by posting a malicious ID to MQTT
CVE-2026-44098	8.6 HIGH	OS Command Injection in OCPP Agent via charge_box_id
CVE-2026-44094	8.6 HIGH	Fallback to second RAUC slot with default credentials
CVE-2026-44099	7.8 HIGH	Local Privilege Escalation via pppd password injection
CVE-2026-44095	7.8 HIGH	Local Privilege Escalation via Network scripts
CVE-2026-44096	7.8 HIGH	udhcpc Privilege Escalation
CVE-2026-44093	7.8 HIGH	Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-applica
CVE-2026-44106	7.8 HIGH	Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer web
CVE-2026-44107	7.5 HIGH	Exposed Reboot via Modbus
CVE-2026-44097	7.1 HIGH	File Upload vulnerability
CVE-2026-44105	6.6 MEDIUM	Cleartext password in logs
CVE-2026-44103	5.3 MEDIUM	JupiCore does not perform validation of firmware

IV. Related Vulnerabilities

Same product: CHARX SEC-3150

Same vendor: Phoenix Contact

Same weakness: CWE-362