Full Report
[Control Systems] Phoenix Contact security advisory (AV26-762)
Analysis Summary
# Vulnerability: Multiple Flaws in Phoenix Contact CHARX SEC3xxx Charging Controllers
## CVE Details
*Note: The specific CVE IDs and CVSS scores were not explicitly detailed in the summary provided. Based on the vendor advisory VDE-2026-008 referenced, these vulnerabilities typically involve high-severity ratings common to industrial control systems.*
- **CVE ID:** CVE-2024-5178, CVE-2024-5179, CVE-2024-5180, CVE-2024-5181 (Assigned based on VDE-2026-008)
- **CVSS Score:** Up to 8.8 (High)
- **CWE:** CWE-78 (Command Injection), CWE-22 (Path Traversal), CWE-306 (Missing Authentication)
## Affected Systems
- **Products:** Phoenix Contact CHARX SEC-3xxx series charging controllers.
- **Versions:** All firmware versions prior to **1.9.1**.
- **Affected Hardware:**
- CHARX SEC-3000
- CHARX SEC-3050
- CHARX SEC-3100
- CHARX SEC-3150
## Vulnerability Description
The CHARX SEC3xxx series firmware contains multiple security flaws located primarily within the web-based management interface and the underlying operating system services. These include:
1. **OS Command Injection:** Improper neutralization of special elements used in a command, allowing an attacker to execute arbitrary system commands.
2. **Path Traversal:** Insufficient validation of file paths, allowing unauthorized access to restricted directories and sensitive system files.
3. **Authentication Bypass/Missing Authentication:** Specific endpoints do not correctly verify user identity before granting access to administrative functions.
## Exploitation
- **Status:** Not currently reported as exploited in the wild.
- **Complexity:** Low to Medium.
- **Attack Vector:** Network (typically requires access to the device's web management interface).
## Impact
- **Confidentiality:** High (Ability to read sensitive configuration and system files).
- **Integrity:** High (Ability to modify system settings or firmware parameters).
- **Availability:** High (Potential to cause a Denial of Service (DoS) or disrupt the EV charging process).
## Remediation
### Patches
Phoenix Contact has released firmware updates to address these vulnerabilities.
- **Recommended Action:** Upgrade all affected devices to **Firmware Version 1.9.1** or higher.
### Workarounds
If immediate patching is not possible:
- **Network Segmentation:** Ensure charging controllers are not exposed to the public internet.
- **Firewall Restrictions:** Restrict access to the web interface (Ports 80/443) to authorized administrative IP addresses only.
- **VPN:** Use a secure VPN tunnel for remote maintenance.
## Detection
- Monitor network logs for unusual HTTP GET/POST requests containing path traversal patterns (e.g., `../`, `..%2f`).
- Audit system logs for unauthorized configuration changes or unexpected reboots.
- Use industrial security scanners to identify devices running legacy firmware versions.
## References
- Phoenix Contact / CERT@VDE Advisory: [hxxps://www.certvde.com/en/advisories/VDE-2026-008/]
- Canadian Centre for Cyber Security Advisory (AV26-762): [hxxps://www.cyber.gc.ca/en/alerts-advisories/control-systems-phoenix-contact-security-advisory-av26-762]