ZDI-CAN-28999: ZDI-26-515: (Pwn2Own) Phoenix Contact CHARX SEC-3150 charx-jupicore Missing Authentication Configuration Modification Vulnerability
Published Jul 30, 2026
·Updated
This vulnerability allows network-adjacent attackers to modify configuration on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.2. The following CVEs are assigned: CVE-2026-44100.
Affected Software
1 affected component
Phoenix Contact CHARX SEC-3150
Event History
Jul 30, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-28999?
ZDI-CAN-28999 has a CVSS rating of 4.2, indicating a moderate severity level.
2
How do I fix ZDI-CAN-28999?
To address ZDI-CAN-28999, ensure proper authentication and access controls are implemented for Phoenix Contact CHARX SEC-3150 devices.
3
What devices are affected by ZDI-CAN-28999?
The vulnerability affects Phoenix Contact CHARX SEC-3150 devices.
4
Is authentication required to exploit ZDI-CAN-28999?
No, authentication is not required to exploit ZDI-CAN-28999.
5
What type of attack does ZDI-CAN-28999 facilitate?
ZDI-CAN-28999 allows network-adjacent attackers to modify configurations on the affected devices.