CVE-2024-25996: Charx Sec-3000 Firmware RCE Vulnerability

CVE-2024-25996 Overview

CVE-2024-25996 is a critical remote code execution vulnerability affecting Phoenix Contact CHARX SEC series electric vehicle charging controllers. The vulnerability stems from an origin validation error that allows unauthenticated remote attackers to execute arbitrary code on vulnerable devices. While the access is limited to the service user context, successful exploitation could allow attackers to compromise EV charging infrastructure, potentially affecting critical energy systems.

Critical Impact

Unauthenticated remote code execution on Phoenix Contact CHARX SEC EV charging controllers enables attackers to compromise charging infrastructure without any credentials.

Affected Products

• Phoenix Contact CHARX SEC-3000 Firmware
• Phoenix Contact CHARX SEC-3050 Firmware
• Phoenix Contact CHARX SEC-3100 Firmware
• Phoenix Contact CHARX SEC-3150 Firmware

Discovery Timeline

• 2024-03-12 - CVE-2024-25996 published to NVD
• 2025-01-23 - Last updated in NVD database

Technical Details for CVE-2024-25996

Vulnerability Analysis

This vulnerability is classified under CWE-346 (Origin Validation Error), which occurs when a product does not properly verify that the source of data or communication is valid. In the context of the Phoenix Contact CHARX SEC controllers, the firmware fails to adequately validate the origin of incoming requests, allowing attackers to bypass authentication mechanisms and execute arbitrary commands on the affected devices.

The affected CHARX SEC series devices are industrial EV charging controllers used in critical infrastructure environments. The network-accessible nature of the vulnerability combined with no authentication requirements makes this a particularly dangerous flaw for organizations deploying these controllers in public or semi-public charging stations.

Root Cause

The root cause of CVE-2024-25996 lies in improper origin validation within the firmware of Phoenix Contact CHARX SEC controllers. The device's web service or API endpoint fails to verify the legitimacy of incoming request origins, allowing attackers to craft malicious requests that are accepted and processed by the device. This weakness enables request forgery attacks that can escalate to remote code execution within the service user context.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the vulnerable CHARX SEC controller can send specially crafted requests that exploit the origin validation flaw. The attack flow involves:

1. Identifying an exposed CHARX SEC controller on the network
2. Crafting a malicious request that bypasses origin validation checks
3. Submitting the request to execute arbitrary code on the device
4. Gaining code execution within the service user context

While the code execution is limited to the service user account, this level of access could still enable manipulation of charging operations, data exfiltration, lateral movement within the network, or denial of service conditions affecting EV charging availability.

Detection Methods for CVE-2024-25996

Indicators of Compromise

• Unexpected outbound network connections from CHARX SEC controllers to unknown IP addresses
• Unusual process execution or service behavior on CHARX SEC devices
• Anomalous log entries indicating failed or suspicious authentication attempts
• Modified firmware or configuration files on affected controllers

Detection Strategies

• Monitor network traffic to and from CHARX SEC controllers for anomalous patterns or connections to unknown endpoints
• Implement network segmentation to isolate industrial control devices and log all cross-segment communications
• Deploy intrusion detection systems (IDS) with signatures for origin validation bypass attempts
• Regularly audit firmware versions to identify unpatched CHARX SEC devices

Monitoring Recommendations

• Enable verbose logging on CHARX SEC controllers to capture detailed request and authentication data
• Establish baseline network behavior for charging infrastructure and alert on deviations
• Monitor for unauthorized firmware modifications or configuration changes on CHARX SEC devices

How to Mitigate CVE-2024-25996

Immediate Actions Required

• Review the VDE Security Advisory VDE-2024-011 for official vendor guidance and patch information
• Isolate affected CHARX SEC controllers from untrusted networks immediately
• Implement strict network access controls to limit which hosts can communicate with the controllers
• Monitor affected devices for signs of compromise while awaiting patching

Patch Information

Phoenix Contact has addressed this vulnerability in updated firmware releases. Organizations should consult the VDE Security Advisory VDE-2024-011 for specific firmware version information and download links. Apply the latest available firmware to all affected CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 devices as soon as possible.

Workarounds

• Implement network segmentation to isolate CHARX SEC controllers from public or untrusted network segments
• Deploy a firewall or access control list (ACL) to restrict network access to the controller's management interfaces to authorized hosts only
• Use a VPN or other secure tunnel for remote administration of charging infrastructure
• Disable unused network services on the CHARX SEC controllers if configuration options permit

# Example network segmentation using iptables (adjust for your environment)
# Restrict access to CHARX SEC controller management port (example port 443)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP