Remote File Upload Vulnerability in Firmware Update Endpoint for Vendor Products
CVE-2026-44097

5.3MEDIUM

Key Information:

Vendor: Phoenix Contact
Status: Charx Sec-3150; Charx Sec-3100; Charx Sec-3050; Charx Sec-3000
Vendor: CVE Published:; 30 July 2026

🔔 Create Phoenix Contact Vulnerability Alert

What is CVE-2026-44097?

A remote attacker with 'operator' level access can exploit a vulnerability in the firmware update endpoint to upload arbitrary files. This can lead to persistent storage of malicious files controlled by the attacker, potentially exhausting system resources, and may result in a Denial-of-Service condition. This vulnerability poses significant security risks and necessitates immediate attention to safeguard against potential exploits.

Affected Version(s)

CHARX SEC-3000 1.0.0 < 1.9.1

CHARX SEC-3050 1.0.0 < 1.9.1

CHARX SEC-3100 1.0.0 < 1.9.1

References

https://www.certvde.com/en/advisories/VDE-2026-008/

CVSS V4

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 30, 2026
Vulnerability Reserved
May 5, 2026

Credit

ZDI

CVE-2026-44097 Data

JSON