(Pwn2Own) Phoenix Contact CHARX SEC-3150 charx-jupicore Missing Authentication Configuration Modification Vulnerability

July 30th, 2026
ZDI-26-515 ZDI-CAN-28999

CVE ID

CVE-2026-44100

CVSS Score

4.2 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected Vendors

Phoenix Contact

Affected Products

CHARX SEC-3150

Vulnerability Details

This vulnerability allows network-adjacent attackers to modify configuration on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the charx-jupicore REST API, which listens on TCP port 5555 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to bypass authentication on the system.

Additional Details

Fixed in firmware v1.9.1, available by Aug 12, 2026.
https://certvde.com/en/advisories/VDE-2026-008/


Disclosure Timeline

  • 2026-02-09 - Vulnerability reported to vendor
  • 2026-07-30 - Coordinated public release of advisory
  • 2026-07-30 - Advisory Updated

Credit

Bongeun Koo (@kiddo_pwn) and Evangelos Daravigkas (@freddo_1337) of Team DDOS

Back to Advisories