Phoenix Contact CHARX SEC-3000 Series Unauthenticated OCPP Backend Configuration Vulnerability

A vulnerability exists in Phoenix Contact CHARX SEC-3000 series charging controllers, all versions prior to 1.7.3. An unauthenticated adjacent attacker can exploit this vulnerability to configure a new OCPP backend, due to insecure default settings in the configuration interface.

Impact

Exploitation of this vulnerability could lead to unauthorized configuration changes, potentially allowing for malicious OCPP backend setups.

Remediation

Users are advised to upgrade to firmware version 1.7.3, which addresses this vulnerability. For general security recommendations, refer to the Phoenix Contact Application Note Security.