Attack Chain

1. Attacker gains low-privileged local access to the CHARX SEC charging controller via a standard user account or compromised management interface.
2. Attacker identifies the specific network configuration script that processes user-supplied input without proper validation.
3. Attacker crafts a malicious command string containing shell metacharacters designed to break out of the intended script parameters.
4. Attacker executes the malicious string via the vulnerable script interface.
5. The script fails to sanitize the input, passing the concatenated command to the underlying system shell.
6. The shell executes the injected payload with root privileges (UID 0), granting the attacker full administrative access to the device.
7. Attacker establishes persistence or performs unauthorized actions such as disabling security controls, modifying device traffic, or exfiltrating sensitive operational data.

Impact

Successful exploitation of CVE-2026-44095 grants an attacker root access to the affected CHARX charging controllers. This enables full control over the device, which may lead to service disruption, manipulation of charging parameters, or unauthorized access to the broader industrial network environment. Organizations using these devices in critical infrastructure or public EV charging deployments are at risk of localized physical and digital impact if the controllers are compromised at scale.

Recommendation

• Upgrade all affected Phoenix Contact CHARX SEC-3000, 3050, 3100, and 3150 controllers to firmware version 1.9.1 or higher to remediate CVE-2026-44095.
• Restrict physical and logical access to the management console of the charging controllers to prevent unauthorized local user sessions.
• Monitor local system logs on charging controllers for unexpected process execution by non-administrative user accounts.
• Audit custom scripts or configuration files on the device for improper handling of shell input parameters.

Attack Chain

1. Attacker performs network reconnaissance to identify exposed CHARX SEC controllers (e.g., scanning for open ports associated with MQTT).
2. Attacker bypasses perimeter firewall protections if the device is misconfigured or exposed via port forwarding.
3. Attacker establishes a TCP connection to the MQTT broker port (typically 1883 or 8883) on the target controller.
4. Attacker transmits unauthenticated MQTT control packets to the broker.
5. The broker, lacking authentication, accepts the connection and processes the malicious commands.
6. Attacker leverages MQTT topics to send commands to internal device functions or application-layer services.
7. The device executes the commands with high-level privileges, leading to a full system compromise.

Impact

Successful exploitation of CVE-2026-44090 results in full compromise of the CHARX SEC controller. This can lead to unauthorized control over industrial or charging processes, loss of operational integrity, and potential lateral movement into the wider industrial control network. The impact is assessed as high across confidentiality, integrity, and availability (CVSS 9.8).

Recommendation

1. Upgrade all affected Phoenix Contact CHARX SEC controllers to firmware version 1.9.1 or later immediately.
2. Audit firewall configurations to ensure that the MQTT broker ports are not exposed to untrusted networks.
3. Implement network segmentation to ensure that only authorized services can reach the MQTT broker interface on industrial controllers.
4. Deploy network-based intrusion detection signatures to identify unauthorized MQTT traffic patterns targeting the specific CHARX SEC devices in the environment.