Phoenix Contact CHARX SEC-3150 up to 1.9.0 inclusion of functionality from untrusted control sphere

Summaryinfo

A vulnerability has been found in Phoenix Contact CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100 and CHARX SEC-3150 up to 1.9.0 and classified as very critical. This affects an unknown function. This manipulation causes inclusion of functionality from untrusted control sphere. This vulnerability is tracked as CVE-2026-44108. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Phoenix Contact CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100 and CHARX SEC-3150 up to 1.9.0. It has been declared as very critical. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a inclusion of functionality from untrusted control sphere vulnerability. The CWE definition for the vulnerability is CWE-829. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.

It is possible to read the advisory at certvde.com. This vulnerability is known as CVE-2026-44108 since 05/05/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/30/2026).

Upgrading to version 1.9.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51043). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Phoenix Contact

Name

• CHARX SEC-3000
• CHARX SEC-3050
• CHARX SEC-3100
• CHARX SEC-3150

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9.0

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion