Critical severity · published Jul 30, 2026
CVE-2026-44104
ControllerAgent does not perform validation of firmware
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
CHARX SEC-3000 · Phoenix Contact
1.0.0 before 1.9.1 · source: vendor
CS
CHARX SEC-3050 · Phoenix Contact
1.0.0 before 1.9.1 · source: vendor
CS
CHARX SEC-3100 · Phoenix Contact
1.0.0 before 1.9.1 · source: vendor
CS
CHARX SEC-3150 · Phoenix Contact
1.0.0 before 1.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44104
www.certvde.com
https://www.certvde.com/en/advisories/VDE-2026-008/
More from CHARX SEC-3000
9.8
CVE-2026-7849
Command Injection in SCM (idledisconnect parameter)
9.8
CVE-2026-44108
Firewall bypass during shutdown
9.8
CVE-2026-44101
OCPP reconfiguration vulnerability
9.8
CVE-2026-44090
Missing authentication for MQTT Broker
9.8
CVE-2025-25270
Remote Code Execution via Unauthenticated Configuration Manipulation