PT-2026-66425 · Phoenix Contact · Charx Sec-3150

CVE-2026-44097 · Published 2026-07-30 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 (affected versions not specified)

Description A low-privileged remote attacker with operator access can upload arbitrary files through the REST endpoint used for firmware updates. This allows for the persistent storage of attacker-controlled files and may lead to resource exhaustion, potentially resulting in a Denial-of-Service (a condition where a system becomes unavailable to its intended users).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-44097

ZDI-26-513

Affected Products

Charx Sec-3150

References · 3

• https://zerodayinitiative.com/advisories/ZDI-26-513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44097 · Security Note
• https://certvde.com/en/advisories/VDE-2026-008 · Note