Phoenix Contact CHARX SEC-3xxx Charging Controllers Out-of-Bounds Write Vulnerability

A vulnerability allowing unauthenticated remote attackers to send MQTT messages that trigger out-of-bounds writes has been identified in Phoenix Contact CHARX SEC-3xxx charging controllers. This issue affects versions through 1.6.5 and versions prior to 1.7.3. The vulnerability leads to a loss of integrity specifically for EichrechtAgents and could cause a denial-of-service condition for the affected charging stations.

Impact

Exploitation of this vulnerability could result in a loss of integrity for EichrechtAgents and cause a denial-of-service condition for the affected charging stations.

Remediation

Users are advised to upgrade to firmware version 1.7.3, which addresses vulnerabilities CVE-2025-24005 and CVE-2025-24006. However, for vulnerabilities CVE-2025-24002, CVE-2025-24003, and CVE-2025-24004, which impact the Eichrecht functionality in firmware versions through 1.6.5, no vendor fix is currently planned. For general security recommendations, refer to the Phoenix Contact Application Note Security.