CVE-2024-26288 PHOENIX CONTACT: Lack of SSL support in CHARX Series

An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected...

CVE-2024-26288 PHOENIX CONTACT: Lack of SSL support in CHARX Series

An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected...

CVE-2024-26005 PHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX Series

An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS...

CVE-2024-26004 PHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX Series

An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality...

CVE-2024-26003 PHOENIX CONTACT: DoS of the control agent in CHARX Series

An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality...

CVE-2024-26001 PHOENIX CONTACT: Out of bounds write only memory access

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

CVE-2024-26000 PHOENIX CONTACT: Out of bounds read only memory access

An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

CVE-2024-25998 PHOENIX CONTACT: Command injection in the OCPP Service

An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation...

CVE-2024-25998 PHOENIX CONTACT: Command injection in the OCPP Service

An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation...

CVE-2024-25997 PHOENIX CONTACT: Log injection in CHARX Series

An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected...

CVE-2024-25997 PHOENIX CONTACT: Log injection in CHARX Series

An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected...

CVE-2024-25995 PHOENIX CONTACT: Remote code execution in CHARX Series

An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation...

CVE-2024-25995 PHOENIX CONTACT: Remote code execution in CHARX Series

An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation...

CVE-2024-25994 PHOENIX CONTACT: Unintended script file upload in CHARX Series

An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only...

CVE-2024-25994 PHOENIX CONTACT: Unintended script file upload in CHARX Series

An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only...

CVE-2024-26521

HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...

Design/Logic Flaw

HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...

PHOENIX CONTACT CHARX SEC Buffer Error Vulnerability

The PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. An input validation error vulnerability exists in Phoenix Contact CHARX SEC-3000 versions prior to v1.5.1, which stems from incorrect input validation and could allow an unauthenticated, remote...

CVE-2024-26521

HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...

PT-2024-21273 · Phoenix Contact · Charx Sec-3100

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 affected versions not specified Description: An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful...