CVE-2024-25995: Phoenixcontact Charx Sec-3000 RCE Flaw

CVE-2024-25995 Overview

CVE-2024-25995 is a critical improper input validation vulnerability affecting Phoenix Contact CHARX SEC series EV (Electric Vehicle) charging controllers. An unauthenticated remote attacker can exploit this flaw to modify device configurations, enabling remote code execution with root privileges or causing denial of service conditions. This vulnerability poses significant risks to critical infrastructure environments where these charging controllers are deployed.

Critical Impact

Unauthenticated attackers can achieve remote code execution with root privileges, enabling complete device compromise and potential disruption of EV charging infrastructure.

Affected Products

• Phoenix Contact CHARX SEC-3000 (Firmware)
• Phoenix Contact CHARX SEC-3050 (Firmware)
• Phoenix Contact CHARX SEC-3100 (Firmware)
• Phoenix Contact CHARX SEC-3150 (Firmware)

Discovery Timeline

• 2024-03-12 - CVE-2024-25995 published to NVD
• 2025-01-30 - Last updated in NVD database

Technical Details for CVE-2024-25995

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the configuration handling mechanisms of Phoenix Contact CHARX SEC series charging controllers. The affected devices fail to properly sanitize or validate input received through network-accessible configuration interfaces, allowing attackers to inject malicious configuration data that can be leveraged to execute arbitrary code on the underlying system.

The exploitation path is particularly concerning because it requires no authentication, meaning any network-reachable attacker can attempt exploitation. The vulnerability affects multiple device models in the CHARX SEC product line, which are commonly deployed in commercial and public EV charging infrastructure.

Root Cause

The root cause is improper input validation (CWE-20) in the firmware's configuration processing routines. The affected devices do not adequately verify or sanitize user-supplied input before processing configuration changes. This lack of proper validation allows attackers to craft malicious configuration payloads that escape intended boundaries, ultimately leading to arbitrary code execution or system instability.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker with network access to the vulnerable device can send specially crafted configuration requests that exploit the improper input validation flaw. Successful exploitation grants the attacker root-level access to the device, enabling full control over the charging controller's operations and potentially allowing lateral movement to connected infrastructure systems.

The vulnerability can be exploited to achieve three primary outcomes:

1. Remote Code Execution - Execute arbitrary commands on the device
2. Root Privilege Access - Gain complete administrative control
3. Denial of Service - Disrupt normal charging controller operations

For detailed technical information, refer to the VDE Security Advisory VDE-2024-011 and the Zero Day Initiative Advisory ZDI-24-856.

Detection Methods for CVE-2024-25995

Indicators of Compromise

• Unexpected configuration changes on CHARX SEC devices without authorized administrative action
• Unusual outbound network connections from charging controllers to unknown external IP addresses
• Evidence of new processes or services running on the device outside of normal operations
• Log entries indicating failed or successful configuration modification attempts from unauthorized sources

Detection Strategies

• Implement network traffic analysis to detect anomalous communication patterns to and from CHARX SEC controllers
• Monitor configuration change logs for unauthorized modifications to device settings
• Deploy intrusion detection rules targeting unexpected network requests to CHARX SEC management interfaces
• Establish baseline behavior profiles for charging controllers and alert on deviations

Monitoring Recommendations

• Enable comprehensive logging on all Phoenix Contact CHARX SEC devices and centralize log collection
• Implement network segmentation monitoring to detect any attempts to access charging controller management interfaces from unauthorized network segments
• Configure alerts for configuration file changes or system reboots that occur outside of scheduled maintenance windows

How to Mitigate CVE-2024-25995

Immediate Actions Required

• Isolate affected CHARX SEC devices from untrusted networks immediately
• Implement strict network access controls to limit management interface exposure
• Review device configurations for signs of unauthorized modifications
• Contact Phoenix Contact for updated firmware and apply patches as soon as available

Patch Information

Organizations should consult the official VDE Security Advisory VDE-2024-011 for specific patch information and firmware update guidance from Phoenix Contact. Apply all available security updates as soon as they are released.

Workarounds

• Place CHARX SEC controllers behind a properly configured firewall that restricts access to management interfaces
• Implement network segmentation to isolate charging infrastructure from general network traffic
• Deploy a VPN or other secure remote access solution for administrative access rather than exposing management interfaces directly
• Consider disabling remote configuration capabilities if feasible until patches are applied

# Example firewall rule to restrict access to CHARX SEC management interface
# Adjust IP ranges and ports according to your environment
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP