PT-2024-7101 · Phoenix Contact · Phoenix Contact Charx Sec-3000

Alex Olson + 4 · Published 2024-08-13 · Updated 2025-08-22 · CVE-2024-6788

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3000 versions up to 1.6.2

Description A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user user-app to the default password. The issue is related to insecure default resource initialization.

Recommendations For Phoenix Contact CHARX SEC-3000 versions up to 1.6.2, update the firmware to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the firmware update feature on the LAN interface to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1392

CWE-1188

Related Identifiers

BDU:2024-08368

CVE-2024-6788

Affected Products

Phoenix Contact Charx Sec-3000

References · 13

• https://bdu.fstec.ru/vul/2024-08368 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6788 · Security Note
• https://twitter.com/CveFindCom/status/1823352096634053115 · Twitter Post
• https://cert.vde.com/en/advisories/VDE-2024-022 · Note
• https://twitter.com/transilienceai/status/1848896576745328796 · Twitter Post
• https://twitter.com/oktsec/status/1824917673278337112 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1823355196954550449 · Twitter Post
• https://twitter.com/cracbot/status/1825050098684027082 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1823413822536691876 · Twitter Post
• https://t.me/cvedetector/3019 · Telegram Post
• https://twitter.com/CVEnew/status/1823353154785640580 · Twitter Post
• https://t.me/cveNotify/133159 · Telegram Post