ZDI-26-519: (Pwn2Own) Phoenix Contact CHARX SEC-3150 CharxSystemConfigManager Configuration Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-44099.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-519?
The severity of ZDI-26-519 is rated at 7.5 according to the CVSS scoring system.
How do I fix ZDI-26-519?
To fix ZDI-26-519, ensure that you update the Phoenix Contact CHARX SEC-3150 devices with the latest patches provided by the manufacturer.
What type of attack can be performed using ZDI-26-519?
ZDI-26-519 allows network-adjacent attackers to perform remote code execution on affected devices.
Is authentication required to exploit ZDI-26-519?
No, authentication is not required to exploit the vulnerability identified by ZDI-26-519.
Which devices are affected by ZDI-26-519?
Phoenix Contact CHARX SEC-3150 devices are affected by the ZDI-26-519 vulnerability.