ZDI-26-520: Pre-auth RCE in Phoenix Contact EV Charging Controller

On July 30, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-520 detailing a remote code execution vulnerability in the Phoenix Contact CHARX SEC-3150 industrial EV charging controller. The flaw, demonstrated at Pwn2Own, resides in the firmware-update endpoint where an unvalidated user-supplied string allows manipulation of the firmware update path. The impact is immediate for charging-infrastructure operators and smart-grid systems: an attacker on the same local network can execute arbitrary code without credentials, with potential extension to physical control of the chargers.

The Mechanism: How an Unvalidated Firmware Path Opens Remote Control

Advisory ZDI-26-520 pinpoints the attack surface: the firmware-update endpoint of the Jupicore OS that governs the CHARX SEC-3150 controller. The vulnerability, classified as "External Control of Path," stems from the failure to validate a user-supplied string before it is used to construct the firmware update path.

This gap allows manipulation of the update flow to overwrite arbitrary files or load malicious firmware. The code then executes in the context of the charging controller with privileges sufficient to compromise the device. The source specifies that exploitation requires a network-adjacent condition: the attacker must reside on the same network as the device; it is not an attack traversable from the internet without intermediation.

"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability." — ZDI-26-520 advisory

The Pwn2Own Chain: An Ecosystem of Interconnected Bugs

The vulnerability emerges from a specific context: the Pwn2Own framework, where researchers demonstrate real-world exploits against industrial and IoT targets. The presence of "Jupicore" in the advisory title indicates the flaw affects the software subsystem dedicated to the device's firmware management, not the charging application per se.

A significant element in the advisory is the reference to execution "in conjunction with other vulnerabilities." This signals that ZDI-26-520 likely represents a link in a broader exploit chain, where control of the firmware path serves as a building block to achieve code execution with more extensive effects. The source does not detail what these complementary vulnerabilities are, nor whether they were disclosed concurrently or fall under other advisories in the same Pwn2Own series.

Disclosure Timeline: Six Months from Report to Coordinated Release

The timeline documented by the advisory shows a classic responsible-disclosure cycle: initial vendor notification occurred on February 9, 2026, with coordinated release on July 30, 2026. This roughly five-and-a-half-month window allowed Phoenix Contact to develop firmware v1.9.1, which corrects the defect.

The public fix availability date — by August 12, 2026 — leaves a time window during which unpatched devices remain exposed. The source does not specify whether Phoenix Contact distributed any prior partial updates or whether v1.9.1 represents the first corrective action for this issue.

Gaps in the Dossier and Technical Unknowns

While structured and authoritative, advisory ZDI-26-520 has areas of documentary incompleteness. No CVE identifier has been assigned, nor is a CVSS score or vector reported. This prevents placing the vulnerability in quantitative risk-prioritization frameworks, though the pre-authentication nature of the RCE and the industrial context signal inherent criticality.

The dossier contains no public proof-of-concept or technical description of the payload. Exploitation in the wild is not documented. Also unquantified is the installed base of CHARX SEC-3150 devices actually deployed and their exposure in network configurations where the network-adjacent condition is practically realizable — for example, in guest Wi-Fi networks or smart-grid segments with controlled but non-isolated access.

Why It Matters

The source does not specify compensating measures or workarounds applicable while awaiting the firmware update. The dossier does not document whether Phoenix Contact has issued its own bulletins or supplementary operational recommendations beyond the ZDI advisory. It is not indicated whether the vulnerability affects exclusively the firmware version prior to v1.9.1 or whether variants of the CHARX SEC-3150 exist with different exposure levels.

The brief provides no guidance on methods for detecting compromise or audit logs that would allow identification of exploit attempts against the firmware-update endpoint. The absence of these elements constitutes an operational limitation for administrators who need to assess whether devices under their management have already been targeted by malicious activity.

Finally, the source does not document whether the CHARX SEC-3150 security architecture includes firmware signature verification or secure boot mechanisms capable of mitigating — even partially — the loading of unauthorized updates, independent of the path-validation vulnerability.

Who Discovered the Flaw

The research is attributed to Bongeun Koo, operating under the handle @kiddo_pwn, and Evangelos Daravigkas, handle @freddo_1337, both members of Team DDOS. Their work was presented in the Pwn2Own context, confirming that the exploit demonstration occurred under controlled competition conditions, not in a real production environment.

Frequently Asked Questions

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-520/
• http://www.zerodayinitiative.com/advisories/published/
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html

Information is based on the cited source and current as of publication.

Sources