Authentication Flaw in CHARX OCPP Agent Service Allows Remote Reconfiguration
CVE-2026-44101

9.3CRITICAL

Key Information:

Vendor: Phoenix Contact
Status: Charx Sec-3150; Charx Sec-3100; Charx Sec-3050; Charx Sec-3000
Vendor: CVE Published:; 30 July 2026

🔔 Create Phoenix Contact Vulnerability Alert

What is CVE-2026-44101?

The CHARX OCPP Agent service has a vulnerability due to missing authentication, allowing an unauthenticated remote attacker to manipulate the backend connection configuration. This flaw poses significant risks, including potential disruption of service (Denial-of-Service) and the leakage of sensitive information to malicious actors. It is imperative for users to assess their systems for this vulnerability to mitigate risks effectively.

Affected Version(s)

CHARX SEC-3000 1.0.0 < 1.9.1

CHARX SEC-3050 1.0.0 < 1.9.1

CHARX SEC-3100 1.0.0 < 1.9.1

References

https://www.certvde.com/en/advisories/VDE-2026-008/

CVSS V4

Score:

9.3

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 30, 2026
Vulnerability Reserved
May 5, 2026

Credit

ZDI

CVE-2026-44101 Data

JSON