CVE-2024-26000: Charx SEC-3000 Information Disclosure Flaw

CVE-2024-26000 Overview

CVE-2024-26000 is an out-of-bounds read vulnerability in the MQTT (Message Queuing Telemetry Transport) stack of Phoenix Contact CHARX SEC-3000 series electric vehicle charging controllers. An unauthenticated remote attacker can trigger improper input validation to read memory outside intended boundaries. The flaw is tracked as [CWE-125: Out-of-Bounds Read] and affects multiple firmware variants used in EV charging infrastructure. Memory layout randomization reduces the success rate of brute force attempts, but repeated attacks remain feasible over the network. Exploitation can lead to disclosure of sensitive runtime data from affected charging controllers.

Critical Impact
Unauthenticated remote attackers can leak memory contents from Phoenix Contact CHARX SEC EV charging controllers over the network through malformed MQTT input.

Affected Products

Phoenix Contact CHARX SEC-3000 and CHARX SEC-3000 firmware
Phoenix Contact CHARX SEC-3050 and CHARX SEC-3050 firmware
Phoenix Contact CHARX SEC-3100 / CHARX SEC-3100 firmware and CHARX SEC-3150 / CHARX SEC-3150 firmware

Discovery Timeline

2024-03-12 - CVE-2024-26000 published to the National Vulnerability Database
2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-26000

Vulnerability Analysis

The vulnerability resides in the MQTT protocol stack used by CHARX SEC charging controllers. MQTT is a lightweight publish/subscribe messaging protocol widely deployed in operational technology and Internet of Things (IoT) environments. The implementation fails to properly validate input fields within incoming MQTT packets before reading from memory buffers. An attacker who can reach the MQTT service over the network can craft malformed packets that cause the parser to read past the bounds of an allocated buffer.

The Phoenix Contact CHARX SEC series operates as charging controllers for electric vehicle supply equipment. Out-of-bounds reads in this context can expose process memory containing protocol state, credentials, or other runtime artifacts. Address space layout randomization on the device reduces the reliability of brute force exploitation, but the read primitive itself remains available to unauthenticated attackers.

Root Cause

The root cause is improper input validation [CWE-125] in the MQTT stack parser. Length fields or offsets within MQTT control packets are not adequately checked against the size of the underlying buffer before the parser dereferences them. This permits crafted packet structures to direct read operations beyond the valid memory region.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends crafted MQTT packets to the exposed broker or client interface on a vulnerable CHARX SEC controller. Because brute force exploitation must contend with memory randomization, an attacker typically issues repeated probes to recover useful memory contents. Refer to the VDE Security Advisory VDE-2024-011 for vendor-confirmed technical details.

Detection Methods for CVE-2024-26000

Indicators of Compromise

Unexpected MQTT CONNECT, PUBLISH, or SUBSCRIBE packets from external sources targeting CHARX SEC controllers
Repeated malformed MQTT packets with anomalous length or remaining-length fields against the same device
Unusual outbound traffic volume from charging controllers indicating leaked data exfiltration

Detection Strategies

Deploy network intrusion detection signatures that validate MQTT packet structure and flag malformed length fields
Monitor MQTT broker logs for parsing errors, disconnects, and high rates of connection attempts from single sources
Apply protocol-aware deep packet inspection at OT/IT boundaries to identify MQTT traffic deviating from documented specifications

Monitoring Recommendations

Baseline expected MQTT clients, topics, and traffic volumes for each CHARX SEC controller and alert on deviations
Forward firmware and network telemetry from charging infrastructure to a centralized SIEM for correlation across devices
Track external network reachability of MQTT ports (typically 1883/tcp and 8883/tcp) and alert on any internet-exposed endpoints

How to Mitigate CVE-2024-26000

Immediate Actions Required

Inventory all Phoenix Contact CHARX SEC-3000, 3050, 3100, and 3150 devices and confirm running firmware versions
Restrict network access to MQTT services on affected controllers to trusted management networks only
Apply the firmware update from Phoenix Contact as soon as it is available per VDE-2024-011
Audit existing logs for indicators of malformed MQTT traffic targeting charging infrastructure

Patch Information

Phoenix Contact and CERT@VDE coordinated disclosure through VDE Security Advisory VDE-2024-011. Review the advisory for the current list of fixed firmware versions and apply updates following the vendor's documented upgrade procedure for CHARX SEC controllers.

Workarounds

Segment EV charging controllers onto a dedicated VLAN with strict firewall rules blocking unsolicited MQTT traffic
Place a protocol-aware gateway or MQTT broker proxy in front of vulnerable controllers to filter malformed packets
Disable the MQTT service on controllers where it is not operationally required

bash

# Example firewall restriction limiting MQTT access to a management subnet
iptables -A INPUT -p tcp --dport 1883 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP
iptables -A INPUT -p tcp --dport 8883 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8883 -j DROP