{"document":{"acknowledgments":[{"organization":"CERTVDE","summary":"coordination.","urls":["https://certvde.com/en/"]},{"names":["Piotr Ptaszek","Mateusz Wójcik"],"organization":"ZDI","summary":"reporting."}],"aggregate_severity":{"namespace":"https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale","text":"High"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"VDE-2026-060: A unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers has been discovered.","title":"Summary"},{"category":"description","text":"The vulnerability can lead to restricted information being disclosed to an unauthenticated attacker.","title":"Impact"},{"category":"description","text":"Affected charging controllers are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.","title":"Mitigation"},{"category":"description","text":"Phoenix Contact recommends to upgrade to firmware version 1.9.0 which fixes this vulnerability. ","title":"Remediation"},{"category":"general","text":"For general information and recommendations on security measures to protect network-enabled devices, refer to the application note: [Application Note Security](https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf).","title":"General Recommendation"},{"category":"description","text":"CHARX EVSE charging controller","title":"Product Description"}],"publisher":{"category":"vendor","contact_details":"psirt@phoenixcontact.com","name":"Phoenix Contact GmbH & Co. KG","namespace":"https://phoenixcontact.com/psirt"},"references":[{"category":"external","summary":"PCSA-2026-00007","url":"https://phoenixcontact.com/psirt"},{"category":"external","summary":"Phoenix Contact advisory overview at CERT@VDE","url":"https://certvde.com/de/advisories/vendor/phoenixcontact/"},{"category":"self","summary":"VDE-2026-060: Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers - HTML","url":"https://certvde.com/en/advisories/VDE-2026-060"},{"category":"self","summary":"VDE-2026-060: Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers - CSAF","url":"https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-060.json"},{"category":"external","summary":"Phoenix Contact application note","url":"https://dam-mdc.phoenixcontact.com/asset/156443151564/0a870ae433c19148b80bd760f3a1c1f2/107913_en_03.pdf"}],"title":"Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers","tracking":{"aliases":["VDE-2026-060","PCSA-2026-00007"],"current_release_date":"2026-06-03T10:01:00.000Z","generator":{"date":"2026-06-03T08:37:16.531Z","engine":{"name":"Secvisogram","version":"2.5.44"}},"id":"VDE-2026-060","initial_release_date":"2026-06-03T10:00:00.000Z","revision_history":[{"date":"2026-06-03T10:00:00.000Z","number":"1.0.0","summary":"Initial revision"},{"date":"2026-06-03T10:01:00.000Z","number":"1.0.1","summary":"added \"Firmware\" to the textual description of the relationships."}],"status":"final","version":"1.0.1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"CHARX SEC-3150","product":{"name":"CHARX SEC-3150","product_id":"CSAFPID-11001","product_identification_helper":{"cpe":"cpe:2.3:h:phoenix_contact:charx_sec_3150:*:*:*:*:*:*:*:*","model_numbers":["1138965"]}}},{"category":"product_name","name":"CHARX SEC-3100","product":{"name":"CHARX SEC-3150","product_id":"CSAFPID-11002","product_identification_helper":{"cpe":"cpe:2.3:h:phoenix_contact:charx_sec_3100:*:*:*:*:*:*:*:*","model_numbers":["1139012"]}}},{"category":"product_name","name":"CHARX SEC-3050","product":{"name":"CHARX SEC-3050","product_id":"CSAFPID-11003","product_identification_helper":{"cpe":"cpe:2.3:h:phoenix_contact:charx_sec_3050:*:*:*:*:*:*:*:*","model_numbers":["1139018"]}}},{"category":"product_name","name":"CHARX SEC-3000","product":{"name":"CHARX SEC-3000","product_id":"CSAFPID-11004","product_identification_helper":{"cpe":"cpe:2.3:h:phoenix_contact:charx_sec_3000:*:*:*:*:*:*:*:*","model_numbers":["1139022"]}}}],"category":"product_family","name":"Hardware"},{"branches":[{"category":"product_version_range","name":"vers:generic/>1.0.0|<1.9.0","product":{"name":"Firmware <1.9.0","product_id":"CSAFPID-21001","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3xxx_firmware:*:*:*:*:*:*:*:*","model_numbers":["1138965","1139012","1139018","1139022"]}}},{"category":"product_version","name":"1.9.0","product":{"name":"Firmware 1.9.0","product_id":"CSAFPID-22001","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3xxx_firmware:1.9.0:*:*:*:*:*:*:*","model_numbers":["1138965","1139012","1139018","1139022"]}}}],"category":"product_family","name":"Firmware"}],"category":"vendor","name":"Phoenix Contact"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"],"summary":"Affected products."},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-32001","CSAFPID-32002","CSAFPID-32003","CSAFPID-32004"],"summary":"Fixed products."}],"relationships":[{"category":"installed_on","full_product_name":{"name":"Firmware <1.9.0 installed on CHARX SEC-3150","product_id":"CSAFPID-31001","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3150_firmware:*:*:*:*:*:*:*:*","model_numbers":["1138965"]}},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.9.0 installed on CHARX SEC-3100","product_id":"CSAFPID-31002","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3100_firmware:*:*:*:*:*:*:*:*","model_numbers":["1139012"]}},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.9.0 installed on CHARX SEC-3050","product_id":"CSAFPID-31003","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3050_firmware:*:*:*:*:*:*:*:*","model_numbers":["1139018"]}},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.9.0 installed on CHARX SEC-3000","product_id":"CSAFPID-31004","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3000_firmware:*:*:*:*:*:*:*:*","model_numbers":["1139022"]}},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.9.0 installed on CHARX SEC-3150","product_id":"CSAFPID-32001","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3150_firmware:1.9.0:*:*:*:*:*:*:*","model_numbers":["1138965"]}},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.9.0 installed on CHARX SEC-3100","product_id":"CSAFPID-32002","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3100_firmware:1.9.0:*:*:*:*:*:*:*","model_numbers":["1139012"]}},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.9.0 installed on CHARX SEC-3050","product_id":"CSAFPID-32003","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3050_firmware:1.9.0:*:*:*:*:*:*:*","model_numbers":["1139018"]}},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.9.0 installed on CHARX SEC-3000","product_id":"CSAFPID-32004","product_identification_helper":{"cpe":"cpe:2.3:o:phoenix_contact:charx_sec3000_firmware:1.9.0:*:*:*:*:*:*:*","model_numbers":["1139022"]}},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11004"}]},"vulnerabilities":[{"cve":"CVE-2026-41032","cwe":{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},"notes":[{"audience":"all","category":"description","text":"It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.","title":"CVE Description"}],"product_status":{"fixed":["CSAFPID-32001","CSAFPID-32002","CSAFPID-32003","CSAFPID-32004"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]},"references":[{"category":"external","summary":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - 8.7 - High","url":"https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N"}],"remediations":[{"category":"vendor_fix","details":"Phoenix Contact strongly recommends to upgrade to firmware version 1.9.0 which fixes these vulnerabilities.","group_ids":["CSAFGID-0001"],"restart_required":{"category":"system"}},{"category":"mitigation","details":"Affected charging controllers are designed and developed for the use in closed industrial networks. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall.","group_ids":["CSAFGID-0001"],"restart_required":{"category":"none"}}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":7.5,"environmentalSeverity":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":7.5,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]}],"title":"Unauthenticated Log-Download"}]}