Unauthenticated Remote Access to Phoenix Contact CHARX SEC MQTT Broker

Phoenix Contact has disclosed a critical security vulnerability, CVE-2026-44090, affecting its CHARX SEC series controllers. The vulnerability stems from a missing authentication mechanism within the onboard MQTT broker, which handles message queuing and device communication. Because the broker lacks required authentication, an unauthenticated remote attacker with network reach to the device can interface directly with the broker. While these devices are typically intended to be protected by external firewalls, the absence of internal authentication means that any misconfiguration or firewall bypass permits full unauthorized command execution and device compromise. The vulnerability affects firmware versions prior to 1.9.1. Organizations utilizing these controllers in industrial or EV charging infrastructure should prioritize upgrading to firmware version 1.9.1 or later and verify that network exposure is strictly limited.

Attack Chain

1. Attacker performs network reconnaissance to identify exposed CHARX SEC controllers (e.g., scanning for open ports associated with MQTT).
2. Attacker bypasses perimeter firewall protections if the device is misconfigured or exposed via port forwarding.
3. Attacker establishes a TCP connection to the MQTT broker port (typically 1883 or 8883) on the target controller.
4. Attacker transmits unauthenticated MQTT control packets to the broker.
5. The broker, lacking authentication, accepts the connection and processes the malicious commands.
6. Attacker leverages MQTT topics to send commands to internal device functions or application-layer services.
7. The device executes the commands with high-level privileges, leading to a full system compromise.

Impact

Successful exploitation of CVE-2026-44090 results in full compromise of the CHARX SEC controller. This can lead to unauthorized control over industrial or charging processes, loss of operational integrity, and potential lateral movement into the wider industrial control network. The impact is assessed as high across confidentiality, integrity, and availability (CVSS 9.8).

Recommendation

1. Upgrade all affected Phoenix Contact CHARX SEC controllers to firmware version 1.9.1 or later immediately.
2. Audit firewall configurations to ensure that the MQTT broker ports are not exposed to untrusted networks.
3. Implement network segmentation to ensure that only authorized services can reach the MQTT broker interface on industrial controllers.
4. Deploy network-based intrusion detection signatures to identify unauthorized MQTT traffic patterns targeting the specific CHARX SEC devices in the environment.