Due to missing authentication

CVE-2026-44090 affects Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 AC EV charging controllers running firmware versions 1.0.0 through 1.9.0. The embedded MQTT broker on these devices has zero authentication. Any attacker with network access to the device can publish and subscribe to MQTT topics, gaining full read/write control of charging operations, configuration, and potentially achieving command execution when chained with companion CVEs in the same advisory batch (VDE-2026-008 documents 22 CVEs total, including CVE-2026-7849 for unauthenticated root command injection).

Phoenix Contact rates this 9.8 CRITICAL, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assumes unrestricted network access. That overstates the real-world risk. The MQTT broker is not internet-facing by design — it sits behind the device's host-based firewall and should be on a segmented OT network. However, downgrading too far would be a mistake: prior research by ivision (Jesson Soto Ventura, 2025) demonstrated that the *same MQTT broker on the same device family* was trivially exploitable once reachable, and a companion CVE in this batch (CVE-2026-44108) shows the firewall can terminate prematurely during shutdown, exposing internal services. These are OT devices managing electrical infrastructure, and the blast radius includes charging disruption, billing manipulation, and potential lateral movement to OCPP backends.

Why this verdict

• Firewall dependency reduces effective attack surface. The MQTT broker is not internet-facing by design. The vendor explicitly states protection relies on firewall rules, and the device is intended for segmented OT networks. This makes the AV:N vector misleading for most deployments — effective access is closer to AV:A (adjacent). Adjustment: -1.5 from baseline.
• Companion CVE weakens the firewall assumption. CVE-2026-44108 (firewall premature termination during shutdown) in the same advisory batch means the firewall protection is not absolute. During device restarts or firmware updates, the MQTT broker may be transiently exposed. This partially offsets the firewall friction. Adjustment: +0.5 back.
• Prior PoC on identical attack surface. ivision Research (2025) demonstrated full exploitation of the same unauthenticated MQTT broker on the same CHARX hardware, including memory corruption and privilege escalation. The attack surface is well-understood and tooling exists. Adjustment: +0.2.
• Role multiplier: OT/EV charging infrastructure. (a) *Low-value role*: lab/test charger — MEDIUM impact, isolated. (b) *Typical role*: commercial parking lot charger — operational disruption, billing fraud, denial of charging service. (c) *High-value role*: fleet charging depot, highway rest-stop infrastructure, or utility-managed charging network — disruption of transportation infrastructure, potential pivot to OCPP billing backends, Eichrecht compliance violations. The chain succeeds in the high-value role with blast radius of operational disruption across managed charging sites. EV chargers are OT devices per the high-value role catalog. However, the blast radius is operational (charging disruption) rather than fleet-scale IT compromise or safety-critical. Floor: HIGH.
• EPSS confirms low near-term exploitation probability. At 0.4%, this sits in the bottom quartile. OT/ICS CVEs historically have low EPSS but high consequence when exploited. No weight change, but informs patching urgency.

Why not higher?

CRITICAL would require either active exploitation (not observed), direct internet exposure (not the case — firewall-protected by architecture), or safety-critical OT impact (EV chargers cause service disruption, not physical safety hazards like PLC/SCADA controllers in industrial processes). The companion firewall CVE creates transient exposure windows, not persistent ones. The installed base of internet-reachable CHARX devices appears negligible per scanning data.

Why not lower?

MEDIUM would undervalue the OT device role and the zero-friction exploitation once network access is achieved. The complete absence of authentication on a critical control interface is a fundamental design failure, not a configuration oversight. The 22-CVE batch (including root command injection) means MQTT access is a gateway to full device compromise. Prior research with public PoC on the same hardware demonstrates this is not theoretical. The OT floor rule applies: EV charging controllers are in the OT/ICS catalog, and operational disruption at scale is plausible.

1. Isolate CHARX controllers on a dedicated OT VLAN with explicit allow-list firewall rules — The MQTT broker has no authentication — network segmentation IS the authentication. Ensure no IT hosts, guest networks, or user devices can reach port 1883 on CHARX controllers. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Block TCP port 1883 (and 8883 if TLS MQTT is configured) at the network boundary — Add explicit deny rules on upstream switches/firewalls for MQTT ports to/from CHARX devices except authorized management stations. This is a 15-minute change that eliminates the attack surface from non-adjacent networks.
3. Monitor for unauthorized MQTT connections to CHARX devices — Deploy IDS rules (Suricata/Zeek) on the OT network segment to alert on any MQTT CONNECT packets to CHARX controller IPs from unauthorized sources. MQTT protocol dissectors are mature in both tools.
4. Disable unnecessary services pending firmware update — If the CHARX web interface allows it, disable the Eichrecht agent and any non-essential MQTT-consuming services to reduce the attack surface from companion CVEs (CVE-2026-7849 command injection).
5. Schedule firmware 1.9.1 deployment for August 12-15, 2026 — Firmware 1.9.1 patches all 22 CVEs. Phoenix Contact has committed to availability by August 12. Plan a maintenance window within the first week of availability. Test on a non-production charger first.

Run this script from any Linux/macOS host on the same network segment as the CHARX controller. Requires mosquitto_sub (from the mosquitto-clients package). Usage: bash check_charx_mqtt.sh 192.168.1.100 where the argument is the CHARX controller IP. No special privileges required.

#!/bin/bash
# check_charx_mqtt.sh - Verify CVE-2026-44090 (unauthenticated MQTT on Phoenix Contact CHARX)
# Usage: bash check_charx_mqtt.sh <CHARX_IP>
# Requires: mosquitto_sub (apt install mosquitto-clients / brew install mosquitto)
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:-}"
PORT=1883
TIMEOUT=5

if [ -z "$TARGET" ]; then
  echo "Usage: $0 <CHARX_CONTROLLER_IP>"
  exit 2
fi

if ! command -v mosquitto_sub &>/dev/null; then
  echo "UNKNOWN - mosquitto_sub not found. Install mosquitto-clients."
  exit 2
fi

# Attempt unauthenticated MQTT connection and subscribe to wildcard for a few seconds
echo "[*] Testing unauthenticated MQTT connection to $TARGET:$PORT ..."

OUTPUT=$(timeout "$TIMEOUT" mosquitto_sub -h "$TARGET" -p "$PORT" -t '#' -C 1 -W "$TIMEOUT" 2>&1) && RC=$? || RC=$?

if [ $RC -eq 0 ] || echo "$OUTPUT" | grep -qi 'received\|connected\|publish'; then
  echo "VULNERABLE - Unauthenticated MQTT connection succeeded on $TARGET:$PORT"
  echo "CVE-2026-44090: MQTT broker accepts connections without authentication."
  echo "Received data: $OUTPUT"
  exit 0
elif echo "$OUTPUT" | grep -qi 'refused\|not authorized\|auth\|forbidden'; then
  echo "PATCHED - MQTT broker on $TARGET:$PORT requires authentication."
  exit 1
elif echo "$OUTPUT" | grep -qi 'Connection timed out\|No route\|Network is unreachable'; then
  echo "UNKNOWN - Cannot reach $TARGET:$PORT (firewall or host down)."
  exit 2
else
  # Timeout with no data could mean connected but no messages, or blocked
  # Try a simple connection test
  CONN_TEST=$(timeout "$TIMEOUT" mosquitto_sub -h "$TARGET" -p "$PORT" -t 'test/noisgate' -W 2 2>&1) && CRC=$? || CRC=$?
  if echo "$CONN_TEST" | grep -qi 'refused\|not authorized\|auth'; then
    echo "PATCHED - MQTT broker on $TARGET:$PORT requires authentication."
    exit 1
  elif [ $CRC -eq 27 ] || [ $CRC -eq 0 ]; then
    echo "VULNERABLE - Unauthenticated MQTT connection accepted (no messages in window, but broker allowed session)."
    exit 0
  else
    echo "UNKNOWN - Inconclusive result (exit code: $CRC). Output: $CONN_TEST"
    exit 2
  fi
fi

Sources

1. NVD - CVE-2026-44090
2. CERT@VDE Advisory VDE-2026-008
3. ivision Research - CHARX SEC-3150 Exploitation
4. Phoenix Contact CHARX SEC-3150 Product Page
5. runZero - Phoenix Contact Vulnerability Asset Discovery
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS