(Pwn2Own) Phoenix Contact CHARX SEC-3150 ModBus Server Exposed Dangerous Function Denial-of-Service Vulnerability

July 30th, 2026
ZDI-26-512 ZDI-CAN-29052

CVE ID

CVE-2026-44107

CVSS Score

6.5 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Vendors

Phoenix Contact

Affected Products

CHARX SEC-3150

Vulnerability Details

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the CharxModbusServer, which listens on port 502 by default. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

Additional Details

Fixed in firmware v1.9.1, available by Aug 12, 2026.
https://certvde.com/en/advisories/VDE-2026-008/


Disclosure Timeline

  • 2026-02-09 - Vulnerability reported to vendor
  • 2026-07-30 - Coordinated public release of advisory
  • 2026-07-30 - Advisory Updated

Credit

PetoWorks (@petoworks)

Back to Advisories