Vulnerability in Phoenix Contact Charx Sec-3000
CVE-2026-44092
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
Vulnerability class: CRLF Injection
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Phoenix Contact Charx Sec-3000 — versions 1.0.0
- Phoenix Contact Charx Sec-3050 — versions 1.0.0
- Phoenix Contact Charx Sec-3100 — versions 1.0.0
- Phoenix Contact Charx Sec-3150 — versions 1.0.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-44092?
- CVE-2026-44092 is a critical-severity vulnerability in Phoenix Contact Charx Sec-3000, classified under CRLF Injection. CVSS score: 9.1/10. Published 2026-07-30.
- How severe is CVE-2026-44092?
- Critical severity. CVSS v3 base score is 9.1 out of 10.