CVE-2026-44104 — ControllerAgent does not perform validation of firmware

CVE-2026-44104

ControllerAgent does not perform validation of firmware PUBLISHED

Description (CNA)

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

Affected (CNA)

Vendor / product	Versions
Phoenix Contact / CHARX SEC-3150	affected 1.0.0 before 1.9.1
Phoenix Contact / CHARX SEC-3100	affected 1.0.0 before 1.9.1
Phoenix Contact / CHARX SEC-3050	affected 1.0.0 before 1.9.1
Phoenix Contact / CHARX SEC-3000	affected 1.0.0 before 1.9.1

CWE

CWE-347

References

https://www.certvde.com/en/advisories/VDE-2026-008/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.