Phoenix Contact CHARX SEC-3xxx Charging Controllers Buffer Copy Vulnerability Leading to Integrity Loss and Denial-of-Service

A vulnerability exists in Phoenix Contact CHARX SEC-3xxx charging controllers, specifically in versions through 1.6.5 and prior to 1.7.3. This vulnerability allows a physical attacker with access to the device's display via USB-C to send a message that triggers an insecure copy to a buffer. This action results in a loss of integrity and causes a temporary denial-of-service on the affected stations, which must be restarted by the watchdog.

Impact

Exploitation of this vulnerability leads to a loss of integrity and a temporary denial-of-service on the affected devices until they are restarted by the watchdog.

Remediation

Users are advised to upgrade to firmware version 1.7.3, which addresses other vulnerabilities but not this specific issue. For general security recommendations, refer to the Phoenix Contact Application Note Security.