Attack Chain

1. Attacker performs network reconnaissance to identify exposed CHARX SEC controllers (e.g., scanning for open ports associated with MQTT).
2. Attacker bypasses perimeter firewall protections if the device is misconfigured or exposed via port forwarding.
3. Attacker establishes a TCP connection to the MQTT broker port (typically 1883 or 8883) on the target controller.
4. Attacker transmits unauthenticated MQTT control packets to the broker.
5. The broker, lacking authentication, accepts the connection and processes the malicious commands.
6. Attacker leverages MQTT topics to send commands to internal device functions or application-layer services.
7. The device executes the commands with high-level privileges, leading to a full system compromise.

Impact

Successful exploitation of CVE-2026-44090 results in full compromise of the CHARX SEC controller. This can lead to unauthorized control over industrial or charging processes, loss of operational integrity, and potential lateral movement into the wider industrial control network. The impact is assessed as high across confidentiality, integrity, and availability (CVSS 9.8).

Recommendation

1. Upgrade all affected Phoenix Contact CHARX SEC controllers to firmware version 1.9.1 or later immediately.
2. Audit firewall configurations to ensure that the MQTT broker ports are not exposed to untrusted networks.
3. Implement network segmentation to ensure that only authorized services can reach the MQTT broker interface on industrial controllers.
4. Deploy network-based intrusion detection signatures to identify unauthorized MQTT traffic patterns targeting the specific CHARX SEC devices in the environment.