CVE-2026-7849: Phoenix Contact CHARX SEC Charging Controller Command Injection - What It Means for Your Business and How to Respond

Introduction

A critical vulnerability in widely deployed electric vehicle charging controllers poses direct risks to operations that rely on charging infrastructure. CVE-2026-7849 affects Phoenix Contact CHARX SEC series devices used in commercial, fleet, and public charging environments across the United States and Canada. Organizations that operate or manage these controllers face potential disruption to charging services, exposure of connected systems, and broader operational impact if the issue remains unaddressed. This post explains why the vulnerability matters to business leaders, outlines who is most exposed, and provides clear guidance on assessing exposure and responding effectively. Technical details appear only in the appendix for security and IT teams.

S1 — Background & History

CERT@VDE published the advisory for CVE-2026-7849 on July 30, 2026, as part of VDE-2026-008 covering multiple issues in Phoenix Contact CHARX SEC-3xxx charging controllers. The vulnerability affects the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models running firmware versions from 1.0.0 up to but not including 1.9.1. It was credited to a ZDI finder. The issue carries a CVSS 3.1 score of 9.8 (Critical) and a CVSS 4.0 score of 9.3 (Critical). In plain language, it is a command injection flaw that allows an unauthenticated remote attacker to inject commands into system configuration that then execute with root privileges. Key timeline events include the coordinated disclosure on July 30, 2026, and the vendor commitment to release fixed firmware version 1.9.1 no later than August 12, 2026. The devices are designed for use in industrial and commercial EV charging setups.

S2 — What This Means for Your Business

For organizations that operate EV charging stations, fleet depots, or commercial parking facilities, this vulnerability creates immediate business risk. An attacker who reaches an affected controller can take complete control of the device. That control can interrupt charging sessions, alter configuration, or use the compromised unit as a foothold into the broader network. Operational disruption translates directly into lost revenue from unavailable chargers, delayed fleet turnaround times, and customer dissatisfaction. Data exposure risks arise if the controller stores or transmits usage records, billing information, or network credentials. Reputation damage follows public reports of charging infrastructure failures or security incidents, especially for companies marketing sustainability or smart mobility services. Compliance exposure exists under frameworks that require protection of operational technology and customer data, including state privacy rules and industry standards for critical infrastructure in the energy and transportation sectors. Even if the charging network sits behind a firewall, any misconfiguration or remote management path can turn a single vulnerable device into a business continuity problem.

S3 — Real-World Examples

Regional Fleet Operator: A mid-sized logistics company running a private charging depot for delivery vans loses several chargers overnight. Drivers cannot complete shifts on schedule, forcing costly rental of replacement vehicles and late deliveries that trigger contract penalties.

Commercial Real Estate Portfolio: A property management firm with multi-tenant office parking equipped with CHARX controllers experiences simultaneous outages across several sites. Tenants complain, leasing renewals slow, and the firm faces emergency service costs plus reputational questions from corporate clients focused on ESG performance.

Municipal Transit Authority: A city transit agency using the controllers for electric bus charging discovers unauthorized changes to charge schedules. Service reliability drops, public complaints rise, and the agency must divert budget from planned expansions to emergency hardening and forensic review.

National Retail Chain: A large retailer with customer-facing EV chargers at store locations finds devices taken offline. Customer traffic declines at those locations, social media amplifies the issue, and the company incurs both direct repair costs and indirect brand impact in competitive markets.

S4 — Am I Affected?

• You operate or manage Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, or SEC-3150 charging controllers.
• Your devices run firmware version 1.9.0 or earlier (any version from 1.0.0 before 1.9.1).
• The controllers are reachable from any network segment that is not fully isolated, including management networks or remote access paths.
• You rely on these devices for commercial, fleet, public, or multi-tenant EV charging services in the United States or Canada.
• You have not yet confirmed firmware version 1.9.1 or later is installed and verified on every unit.
• Your network architecture allows unauthenticated access to the system configuration interface or related services on the controllers.

Key Takeaways

• CVE-2026-7849 is a critical remote command injection vulnerability that grants root-level control of affected Phoenix Contact CHARX SEC charging controllers without authentication.
• Businesses that depend on these devices for fleet operations, commercial parking, or public charging face direct risks to service availability, revenue, and customer trust.
• Exposure is limited to specific CHARX SEC models running firmware before version 1.9.1; confirming and updating firmware is the primary control.
• Even devices intended for closed networks can create material impact if network segmentation or remote management paths are imperfect.
• Prompt inventory, patching, and verification reduce the window of risk while supporting ongoing operational and compliance requirements.

Call to Action

IntegSec helps organizations identify exposure, validate controls, and strengthen defenses around operational technology such as EV charging infrastructure. Contact us for a targeted penetration test that examines your charging environment, network segmentation, and related systems. Visit https://integsec.com to schedule a discussion and take concrete steps toward reduced risk.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

The root cause is improper neutralization of special elements in the idledisconnect parameter processed by the SCM (system configuration manager) component. An unauthenticated remote attacker can inject commands that the system subsequently executes with root privileges. The attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N). Scope remains unchanged. Impact is high across confidentiality, integrity, and availability. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-77 (Improper Neutralization of Special Elements used in a Command) applies. References include the CERT@VDE advisory VDE-2026-008 and the NVD entry for CVE-2026-7849.

B — Detection & Verification

Version enumeration can be performed via the device management interface or vendor tools that report firmware version. Confirm whether the reported version is earlier than 1.9.1. Scanner signatures should flag the presence of CHARX SEC-3000/3050/3100/3150 models and check for the vulnerable firmware range. Log indicators include unexpected configuration changes involving the idledisconnect parameter or anomalous root-level process execution originating from the SCM service. Behavioral anomalies include sudden restarts, unexpected network connections from the controller, or unauthorized modifications to charging schedules and backend settings. Network exploitation indicators include unauthenticated requests targeting configuration endpoints that contain command metacharacters in parameters related to idle disconnect or system configuration.

C — Mitigation & Remediation

1. Immediate (0–24h): Inventory all CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 units. Isolate affected devices from untrusted networks where feasible. Restrict access to management interfaces via firewall rules or network segmentation. Monitor for anomalous configuration activity.
2. Short-term (1–7d): Apply the official Phoenix Contact firmware update to version 1.9.1 as soon as it becomes available (targeted no later than August 12, 2026). Verify successful installation on every device. For environments that cannot patch immediately, enforce strict network isolation so that only authorized management hosts can reach the controllers, and disable unnecessary remote services.
3. Long-term (ongoing): Maintain an asset inventory that tracks firmware versions for all operational technology devices. Integrate regular vulnerability scanning and configuration baseline checks into change management processes. Apply network segmentation principles so that charging controllers reside in restricted zones with limited external reachability. Review remote management and OCPP/backend connectivity for least-privilege access.

D — Best Practices

• Validate and sanitize all input to system configuration parameters, especially those that influence process execution or network settings.
• Enforce strong network segmentation so that EV charging controllers are reachable only from authorized management systems.
• Maintain current firmware inventories and apply vendor patches on a defined schedule with verification steps.
• Disable or tightly control unauthenticated access paths to configuration and management services.
• Monitor configuration change logs and process execution for signs of unauthorized command activity on operational technology devices.