The vulnerability of the CharxSystemConfigManager service in the microprogramming software for modular control devices for AC charging stations and wall-mounted charging devices from Phoenix Contact, CHARX SEC-3100, allows a hacker to execute arbitrary code.

🗓️ 15 Nov 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 8 Views

Charx System Config Manager in Phoenix Contact CHARX SEC 3100 allows remote code execution due to no authentication.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2024-25995	12 Mar 202410:26	–	circl
CNNVD	PHOENIX CONTACT CHARX SEC-3000 Input Validation Error Vulnerability	12 Mar 202400:00	–	cnnvd
CVE	CVE-2024-25995	12 Mar 202408:10	–	cve
Cvelist	CVE-2024-25995 PHOENIX CONTACT: Remote code execution in CHARX Series	12 Mar 202408:10	–	cvelist
EUVD	EUVD-2024-23291	3 Oct 202520:07	–	euvd
NVD	CVE-2024-25995	12 Mar 202409:15	–	nvd
OSV	CVE-2024-25995	12 Mar 202409:15	–	osv
Prion	Remote code execution	12 Mar 202409:15	–	prion
Positive Technologies	PT-2024-8065 · Phoenix Contact · Phoenix Contact Charx Sec-3100	2 Feb 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-25995	5 Feb 202513:04	–	redhatcve

Vulners

Node

phoenix_contact_gmbh_&_co._kg charx_sec-3100Range≤1.5.0

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-CAN-23158
cert	www.cert.vde.com/en/advisories/VDE-2024-011
web	www.web.nvd.nist.gov/view/vuln/detail
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-856/
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-CAN-23158/

15 Nov 2024 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 39.8

CVSS 210

EPSS0.01404

Charx System Config Phoenix Contact Remote code execution No authentication