CVE-2024-26005: Phoenixcontact Charx SEC-3000 Privilege Escalation

CVE-2024-26005 Overview

CVE-2024-26005 affects Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 electric vehicle charging controllers. An unauthenticated remote attacker can gain service-level privileges by exploiting an incomplete cleanup that occurs when a service restarts following a denial-of-service condition. The weakness maps to [CWE-459] (Incomplete Cleanup) and requires no authentication or user interaction.

Critical Impact
Attackers who trigger a service disruption on affected CHARX SEC controllers can leverage residual state during restart to obtain service-level privileges on the charging controller.

Affected Products

Phoenix Contact CHARX SEC-3000 and CHARX SEC-3000 firmware
Phoenix Contact CHARX SEC-3050 and CHARX SEC-3050 firmware
Phoenix Contact CHARX SEC-3100 / CHARX SEC-3150 and their firmware

Discovery Timeline

2024-03-12 - CVE-2024-26005 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26005

Vulnerability Analysis

CVE-2024-26005 stems from incomplete cleanup logic in a network-accessible service running on Phoenix Contact CHARX SEC charging controllers. When the service is restarted after a denial-of-service event, residual state or artifacts from the previous instance remain accessible. An unauthenticated attacker on the network can interact with this stale state to gain the privileges of the restarted service.

The attack sequence combines two primitives: forcing the service into a restart via a DoS trigger, then racing or interacting with the recovery path. Because the flaw resides in the service lifecycle rather than in a specific request handler, standard input filtering does not prevent it.

Exploitation requires high attack complexity, which reflects the timing and environmental conditions an attacker must satisfy to observe the incomplete cleanup window. Confidentiality and integrity impacts are limited to what the affected service can access on the controller, and there is no reported availability impact beyond the DoS used to initiate the sequence.

Root Cause

The root cause is a violation of the resource-cleanup contract during service teardown and restart, categorized as [CWE-459]. State that should be reinitialized, invalidated, or removed persists across the restart boundary, allowing an unauthenticated peer to inherit or reach service-level privileges.

Attack Vector

The attack vector is network-based and requires no credentials. An attacker first induces a denial-of-service condition against the target service on the CHARX SEC controller, then interacts with the service as it restarts to leverage the incomplete cleanup. See the VDE Security Advisory VDE-2024-011 for vendor-provided technical details.

No verified proof-of-concept code has been published for CVE-2024-26005.
Refer to VDE-2024-011 for authoritative technical details.

Detection Methods for CVE-2024-26005

Indicators of Compromise

Unexpected restarts or crashes of network-facing services on CHARX SEC-3000, SEC-3050, SEC-3100, or SEC-3150 controllers.
Repeated malformed or high-volume traffic to management or charging-protocol ports immediately followed by service reconnection attempts.
Configuration changes, log gaps, or new sessions on the controller that do not correlate with authorized operator activity.

Detection Strategies

Correlate service crash or restart events with inbound network activity from untrusted sources to identify DoS-triggered exploitation attempts.
Baseline normal operator interactions with CHARX SEC controllers and alert on deviations, particularly unauthenticated commands issued during recovery windows.
Monitor operational-technology segments for network scans targeting Phoenix Contact charging infrastructure.

Monitoring Recommendations

Forward controller syslog and service-restart events to a centralized SIEM for correlation across the charging fleet.
Enable network intrusion detection on the OT segment hosting the charging controllers, with signatures for repeated connection floods to service ports.
Review authentication and privileged-action logs on the controllers after any unplanned service restart.

How to Mitigate CVE-2024-26005

Immediate Actions Required

Inventory all Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 devices and identify firmware versions in use.
Apply the fixed firmware referenced in VDE Security Advisory VDE-2024-011 as soon as maintenance windows permit.
Restrict network reachability to controller management and charging-protocol services to trusted operator networks only.

Patch Information

Phoenix Contact and CERT@VDE coordinated the disclosure of CVE-2024-26005 in VDE-2024-011. Operators should consult the advisory for the specific fixed firmware versions applicable to each CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 model and follow the vendor's upgrade procedure.

Workarounds

Place CHARX SEC controllers behind a firewall that permits only allow-listed source addresses to reach management services.
Segment charging infrastructure from corporate IT networks and from the public internet.
Monitor for and manually investigate any unexpected service restart; treat the recovery window as untrusted until the controller is patched.

bash

# Example firewall rule concept - restrict access to CHARX SEC management services
# Replace <mgmt_iface>, <operator_subnet>, and <svc_port> with site-specific values
iptables -A INPUT -i <mgmt_iface> -s <operator_subnet> -p tcp --dport <svc_port> -j ACCEPT
iptables -A INPUT -i <mgmt_iface> -p tcp --dport <svc_port> -j DROP