Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-44092 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-08-03 9.1 Critical
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
CVE-2026-44091 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-31 9.1 Critical
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
CVE-2026-7849 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.8 Critical
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
CVE-2026-44104 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.8 Critical
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
CVE-2026-44108 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.8 Critical
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.
CVE-2026-44090 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.8 Critical
Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.
CVE-2026-44095 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 7.8 High
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
CVE-2026-44100 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.4 Critical
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.
CVE-2024-6788 1 Phoenixcontact 12 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 9 more 2025-08-22 8.6 High
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
CVE-2024-25995 1 Phoenixcontact 12 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 9 more 2025-01-30 9.8 Critical
An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation.
CVE-2024-3913 1 Phoenixcontact 12 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 9 more 2025-01-29 5.9 Medium
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.
CVE-2024-28136 1 Phoenixcontact 12 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 9 more 2025-01-24 7.8 High
A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.
CVE-2024-28135 1 Phoenixcontact 12 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 9 more 2025-01-24 5 Medium
A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.
CVE-2024-26001 1 Phoenixcontact 12 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 9 more 2025-01-24 7.4 High
An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
CVE-2024-25998 1 Phoenixcontact 12 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 9 more 2025-01-24 7.3 High
An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation.
CVE-2024-25994 1 Phoenixcontact 12 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 9 more 2025-01-24 5.3 Medium
An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only.