Remote Code Injection Vulnerability in ModbusServer by MQTT Protocol
CVE-2026-44092

8.8HIGH

Key Information:

Vendor

Phoenix Contact

Status
Charx Sec-3150
Charx Sec-3100
Charx Sec-3050
Charx Sec-3000
Vendor
CVE Published:
30 July 2026

What is CVE-2026-44092?

The ModbusServer application is susceptible to a remote code injection vulnerability due to inadequate validation of input sourced from the MQTT protocol. An unauthenticated attacker can exploit this flaw to inject malicious payloads, potentially compromising the system's integrity and availability. Users are advised to implement robust input validation mechanisms to mitigate the risks associated with this vulnerability.

Affected Version(s)

CHARX SEC-3000 1.0.0 < 1.9.1

CHARX SEC-3050 1.0.0 < 1.9.1

CHARX SEC-3100 1.0.0 < 1.9.1

References

https://www.certvde.com/en/advisories/VDE-2026-008/

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ZDI
.