Phoenix Contact CHARX SEC-3000 Insertion of Sensitive Information into Log File Information Disclosure Vulnerability

July 30th, 2026
ZDI-26-522 ZDI-CAN-27763

CVE ID

CVE-2026-41032

CVSS Score

6.5 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Vendors

Phoenix Contact

Affected Products

CHARX SEC-3000

Vulnerability Details

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Phoenix Contact CHARX SEC-3000 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the generation of log files. The issue results from including sensitive information in a log file. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.

Additional Details

Phoenix Contact has issued an update to correct this vulnerability. More details can be found at:
https://certvde.com/en/advisories/VDE-2026-060

Disclosure Timeline

  • 2026-04-16 - Vulnerability reported to vendor
  • 2026-07-30 - Coordinated public release of advisory
  • 2026-07-30 - Advisory Updated

Credit

Piotr Ptaszek and Mateusz Wójcik

Back to Advisories