CVE-2026-44092 — Missing input validation / stripping of CRLF characters in SystemConfigManager

CVE-2026-44092

Missing input validation / stripping of CRLF characters in SystemConfigManager PUBLISHED

Description (CNA)

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

Affected (CNA)

Vendor / product	Versions
Phoenix Contact / CHARX SEC-3150	affected 1.0.0 before 1.9.1
Phoenix Contact / CHARX SEC-3100	affected 1.0.0 before 1.9.1
Phoenix Contact / CHARX SEC-3050	affected 1.0.0 before 1.9.1
Phoenix Contact / CHARX SEC-3000	affected 1.0.0 before 1.9.1

CWE

CWE-93

References

https://www.certvde.com/en/advisories/VDE-2026-008/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.