OS Command Injection Vulnerability in OCPP Backend by OEM
CVE-2026-44098

8.8HIGH

Key Information:

Vendor: Phoenix Contact
Status: Charx Sec-3150; Charx Sec-3100; Charx Sec-3050; Charx Sec-3000
Vendor: CVE Published:; 30 July 2026

🔔 Create Phoenix Contact Vulnerability Alert

What is CVE-2026-44098?

A vulnerability exists in the OCPP backend system that permits an unauthenticated remote attacker to exploit a firewall bypass. This risk leads to OS command injection, allowing the execution of arbitrary commands under the limited privileges of the 'charx-oa' user. As a consequence, this could potentially disrupt charging operations and compromise system integrity. Immediate action is urged for users to apply the necessary patches to secure their systems.

Affected Version(s)

CHARX SEC-3000 1.0.0 < 1.9.1

CHARX SEC-3050 1.0.0 < 1.9.1

CHARX SEC-3100 1.0.0 < 1.9.1

References

https://www.certvde.com/en/advisories/VDE-2026-008/

CVSS V4

Score:

8.8

Severity:

HIGH

Confidentiality:

Low

Integrity:

Low

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 30, 2026
Vulnerability Reserved
May 5, 2026

Credit

ZDI

CVE-2026-44098 Data

JSON