ZDI-26-510: (Pwn2Own) Phoenix Contact CHARX SEC-3150 Missing Cryptographic Signature Remote Code Execution Vulnerability
Published Jul 30, 2026
·Updated
This vulnerability allows network-adjacent attackers to bypass firmware validation on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-44104.
Affected Software
1 affected component
Phoenix Contact CHARX SEC-3150
Event History
Jul 30, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-26-510?
The severity of ZDI-26-510 is rated at 7.5 on the CVSS scale.
2
How do I fix ZDI-26-510?
To fix ZDI-26-510, update the firmware of the Phoenix Contact CHARX SEC-3150 to the latest version provided by the vendor.
3
Who is affected by ZDI-26-510?
Users of Phoenix Contact CHARX SEC-3150 devices are affected by ZDI-26-510.
4
What type of attack can exploit ZDI-26-510?
ZDI-26-510 can be exploited by network-adjacent attackers who can bypass firmware validation.
5
Is authentication required to exploit ZDI-26-510?
No, authentication is not required to exploit the ZDI-26-510 vulnerability.