Phoenix Contact CHARX SEC-3xxx Charging Controllers Unauthenticated API Configuration Modification Vulnerability

A vulnerability exists in Phoenix Contact CHARX SEC-3xxx charging controllers, all versions prior to 1.7.3. An unauthenticated adjacent attacker can modify the device's configuration by sending specific requests to an API endpoint. This vulnerability arises from missing authentication, allowing for unauthorized read and write access to the device's settings.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of the device's configuration, potentially causing a complete loss of confidentiality, integrity, and availability.

Remediation

Users are advised to upgrade to firmware version 1.7.3, which addresses this vulnerability. For general security recommendations regarding network-enabled devices, refer to the Phoenix Contact Application Note Security.