Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 191

Export CSV
CVE-2026-110935

Path traversal in plug-in deployment

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2026-110022

Signed plug-in validation bypass

The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2026-110021

Missing GSDX SignatureValue verification

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2026-44093

Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2025-41769

Unauthenticated Buffer Overflow in PROFINET Service

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Axc F 1152 Axc F 1152 Firmware Axc F 1252 and 26 more
CVE-2026-44092

Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44106

Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44091

Creation of a new configuration by posting a malicious ID to MQTT

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44097

File Upload vulnerability

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44102

OCPP Firmware download is not properly locked

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44107

Exposed Reboot via Modbus

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44104

ControllerAgent does not perform validation of firmware

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44094

Fallback to second RAUC slot with default credentials

An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44108

Firewall bypass during shutdown

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44103

JupiCore does not perform validation of firmware

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-44098

OS Command Injection in OCPP Agent via charge_box_id

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

CVSS 4.0 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more