(Pwn2Own) Phoenix Contact CHARX SEC-3150 user-applications Link Following Local Privilege Escalation Vulnerability

July 30th, 2026
ZDI-26-502 ZDI-CAN-29085

CVE ID

CVE-2026-44106

CVSS Score

7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

Phoenix Contact

Affected Products

CHARX SEC-3150

Vulnerability Details

This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3150 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the user-applications script. By creating a symbolic link, an attacker can abuse the script to move arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.

Additional Details

Fixed in firmware v1.9.1, available by Aug 12, 2026.
https://certvde.com/en/advisories/VDE-2026-008/


Disclosure Timeline

  • 2026-02-09 - Vulnerability reported to vendor
  • 2026-07-30 - Coordinated public release of advisory
  • 2026-07-30 - Advisory Updated

Credit

Nabih Benazzouz from Fuzzinglabs, Julien Cohen-Scali from Fuzzinglabs, Hugo Leclercq from Fuzzinglabs, Patrick Ventuzelo from Fuzzinglabs

Back to Advisories