CVE-2024-25997: Phoenix Contact Charx SEC-3000 Log Injection

CVE-2024-25997 Overview

CVE-2024-25997 is a log injection vulnerability affecting Phoenix Contact CHARX SEC series electric vehicle charging controllers. The flaw stems from improper input validation [CWE-20] in a specific log file handler. An unauthenticated remote attacker can inject arbitrary content into the affected log file over the network. The issue impacts CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 firmware. Phoenix Contact and VDE published coordinated advisory VDE-2024-011 covering the issue. The vulnerability carries limited integrity impact and no direct impact on confidentiality or availability of the charging controller.

Critical Impact
Unauthenticated remote attackers can forge or pollute log entries in an affected log file, undermining the integrity of forensic records on Phoenix Contact CHARX SEC charging controllers.

Affected Products

Phoenix Contact CHARX SEC-3000 and CHARX SEC-3050 firmware
Phoenix Contact CHARX SEC-3100 and CHARX SEC-3150 firmware
Deployments of CHARX SEC charging controllers exposed to untrusted networks

Discovery Timeline

2024-03-12 - CVE-2024-25997 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25997

Vulnerability Analysis

The vulnerability is a log injection issue in the CHARX SEC charging controller firmware. The affected component writes attacker-controlled input into a specific log file without adequate sanitization. An unauthenticated remote attacker can send crafted network requests that cause forged or misleading entries to appear in that log. Only one log file is affected, and confidentiality and availability of the controller remain intact. The primary security impact is on the integrity of logging and downstream detection processes. Investigators relying on the affected log to reconstruct events may see fabricated records, obscured attacker actions, or spoofed source attribution. Phoenix Contact tracks the issue in VDE Security Advisory VDE-2024-011 and provides fixed firmware for the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 product lines.

Root Cause

The root cause is improper input validation [CWE-20] on data received over the network before it is written to a log file. The logging routine does not neutralize newline characters, control characters, or log-format delimiters supplied by the client. As a result, an attacker can embed synthetic log lines within a single request field.

Attack Vector

Exploitation requires network access to the charging controller but no authentication or user interaction. An attacker sends a crafted request containing embedded log-record separators and forged fields. The logging component appends the attacker-supplied string to the affected log file verbatim, producing entries that mimic legitimate events.

// No verified public proof-of-concept is available for CVE-2024-25997.
// See VDE-2024-011 for vendor technical details.

Detection Methods for CVE-2024-25997

Indicators of Compromise

Log entries in the affected CHARX SEC log file containing embedded newline sequences, carriage returns, or unexpected control characters
Duplicate or out-of-order timestamps indicating fabricated records inserted by an external client
Log lines that reference internal usernames, IP addresses, or event codes without a corresponding authenticated session

Detection Strategies

Forward CHARX SEC controller logs to a centralized log store and validate structural consistency of each record
Alert on log records containing raw \n, \r, or non-printable byte sequences within fields that should be single-line
Correlate log-file entries with network flow data to identify records that lack a matching inbound session

Monitoring Recommendations

Baseline the volume and format of CHARX SEC log entries and alert on sudden format deviations
Monitor northbound HTTP or management interfaces of CHARX SEC devices for unauthenticated request bursts
Track firmware versions across the CHARX SEC fleet to confirm patched builds are deployed

How to Mitigate CVE-2024-25997

Immediate Actions Required

Apply the firmware updates released by Phoenix Contact for the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 controllers as described in the VDE Security Advisory VDE-2024-011
Restrict network access to CHARX SEC management interfaces to trusted operator networks only
Review the affected log file for injected records dated before firmware upgrade

Patch Information

Phoenix Contact provides fixed firmware through the coordinated advisory tracked as VDE Security Advisory VDE-2024-011. Operators should consult the advisory for exact fixed firmware versions and upgrade procedures for each CHARX SEC model.

Workarounds

Place CHARX SEC controllers behind a segmented operational technology (OT) network with strict ingress filtering
Terminate remote administration through a VPN or jump host that enforces authentication before reaching the controller
Duplicate log data to an external syslog collector so investigators can compare on-device and off-device records

bash

# Example: restrict inbound access to CHARX SEC management interface
# Replace <mgmt_subnet> and <charx_ip> with your environment values
iptables -A FORWARD -s <mgmt_subnet> -d <charx_ip> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <charx_ip> -p tcp --dport 443 -j DROP