Phoenix Contact CHARX SEC-3000: RCE as Root via Command Injection

CVE-2026-44095 in EV charging security appliances lets an authenticated, network-adjacent attacker execute arbitrary code as root.

On July 30, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-521 detailing a command injection vulnerability in Phoenix Contact CHARX SEC-3000 devices. An authenticated attacker positioned on an adjacent network can execute arbitrary code in the root context by manipulating the config service's defaultroutemetric parameter. The flaw, tracked as CVE-2026-44095, exposes dedicated EV charging security appliances to total compromise.

Severity is confirmed by both CVSS metrics: 8.5 HIGH in version 4.0 and 7.8 HIGH in version 3.1, per the official CVE record. Phoenix Contact has released a patch. The window between private vendor notification on April 14, 2026, and coordinated disclosure spanned 107 days.

Key Takeaways

The vulnerability affects only Phoenix Contact CHARX SEC-3000 devices, security components for EV charging infrastructure.
The vector is a command injection in the config service's defaultroutemetric parameter, caused by missing validation of user-supplied strings before a system call.
Authentication is required: the attacker must hold valid credentials to reach the injection point.
The CVE-2026-44095 record assigns HIGH severity with CVSS 4.0 at 8.5 and CVSS 3.1 at 7.8, classified as CWE-78.

How the Attack Works: From Routing Metric to Root Shell

The flaw resides in the device's config service. Advisory ZDI-26-521 describes the mechanism precisely: the defaultroutemetric parameter, normally used to configure a network routing property, accepts user input without adequate sanitization. The string is passed directly to a system call, opening an attacker-controlled command injection window.

Execution occurs in the root context. This detail elevates the vulnerability from simple privilege escalation to total device compromise: filesystem, system processes, network configurations, and the security stack become accessible without further barriers. The threat model is bounded by the network condition — the attacker must be network-adjacent — but within an EV charging infrastructure that surface is far from negligible.

"The specific flaw exists within the handling of the defaultroutemetric parameter to the config service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call."

Why CHARX SEC-3000 Devices Are a Sensitive Target

Phoenix Contact's CHARX SEC-3000 series forms the security perimeter between charging stations and operational electrical networks. Deployed in public charging stations, enterprise infrastructure, and fleet hubs, they handle authentication, monitoring, and load isolation. Their compromise extends beyond the single asset: a root-compromised device can be reconfigured to intercept communications, alter charging parameters, disconnect vehicles, or serve as a bridge to broader network segments.

The attack angle aligns with a trend observed in industrial and OT systems: seemingly innocuous configuration parameters — routing metrics, environment variables, system flags — become RCE vectors when underlying code assumes input trustworthiness without validation. The config service, privileged by nature, represents the breaking point here.

The ZDI advisory does not specify the affected firmware version nor the installed base size. The required authentication level — whether admin, user, or an intermediate role — also remains undocumented. These gaps limit operators' ability to build precise exposure inventories without direct verification on each device.

Disclosure Context: 107 Days of Coordination

The timeline reveals a standard coordinated disclosure process: private report on April 14, 2026, public release on July 30, 2026. Phoenix Contact issued a patch within this window. The duration, just over three months, places the advisory in line with typical ZDI timelines, which generally grant vendors a remediation period before publication.

The CVE-2026-44095 record on cve.org confirms the CWE-78 classification — Improper Neutralization of Special Elements used in an OS Command — and harmonizes the technical description with the primary advisory. The minor discrepancy between ZDI's "network-adjacent" designation and the "AV:L" (Attack Vector: Local) in CVE.org's CVSS 3.1 does not constitute a substantive conflict: the CVSS 3.1 model compresses network-proximity vectors under broader categories, while the ZDI advisory specifies attacker position with greater granularity.

Immediate Actions

Verify the presence of CHARX SEC-3000 devices in your installed base and confirm patch applicability with Phoenix Contact.
Isolate unpatchable devices immediately on network segments with restricted access, reducing the surface exposed to potential adjacent attackers.
Review config service access logs for anomalous requests targeting the defaultroutemetric parameter in the period preceding disclosure.
Contact Phoenix Contact support for specific update procedure guidance, as the advisory does not detail the remediation process.

A Broader Signal: EV Device Security as the New OT Frontier

Vulnerability ZDI-26-521 fits into a wider narrative arc. The expansion of electric charging infrastructure is extending the OT perimeter beyond traditional plants and substations: every charging station is a network node with security appliances, charge controllers, and communication gateways. These nodes share a common trait — system software that manages network parameters with elevated privileges — and a common weakness: implicit trust in configuration input.

The defaultroutemetric parameter is not an exposed API, a REST endpoint, or a visible web admin panel. It is a technically mundane system configuration field that turns lethal for lack of an elementary check. This pattern — user input traversing the full stack to a system call without validation — is among the oldest and most persistent in industrial codebases, where configuration services often inherit dated architectures.

For charging infrastructure operators, the operational lesson is immediate: security appliances are not impregnable barriers, but software with concrete attack surfaces. Protecting them demands timely patching, network segmentation, and monitoring of internal services with the same rigor reserved for public endpoints.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references