Firmware Update Vulnerability in OCPP Backend by Affected Vendor
CVE-2026-44102

6.9MEDIUM

Key Information:

Vendor: Phoenix Contact
Status: Charx Sec-3150; Charx Sec-3100; Charx Sec-3050; Charx Sec-3000
Vendor: CVE Published:; 30 July 2026

🔔 Create Phoenix Contact Vulnerability Alert

What is CVE-2026-44102?

The vulnerability allows an unauthenticated remote attacker to initiate a firmware update download through the OCPP backend by providing an invalid firmware file. This action leads to the firmware file being temporarily accessible due to inadequate locking mechanisms during the cleanup process, posing a security risk to the affected systems.

Affected Version(s)

CHARX SEC-3000 1.0.0 < 1.9.1

CHARX SEC-3050 1.0.0 < 1.9.1

CHARX SEC-3100 1.0.0 < 1.9.1

References

https://www.certvde.com/en/advisories/VDE-2026-008/

CVSS V4

Score:

6.9

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 30, 2026
Vulnerability Reserved
May 5, 2026

Credit

ZDI

CVE-2026-44102 Data

JSON