CVE-2024-28134 Overview
CVE-2024-28134 affects Phoenix Contact CHARX SEC electric vehicle charging controllers. The vulnerability stems from cleartext transmission of sensitive information [CWE-319]. An unauthenticated remote attacker positioned for a man-in-the-middle (MitM) attack can extract a valid session token from network traffic. The attacker then reuses the token to gain web-based management access with the privileges of the currently logged in user. No additional user interaction is required to complete the attack chain. Access through the hijacked session is limited to non-sensitive information disclosure, but availability of the charging controller can be seriously affected.
Critical Impact
Network-positioned attackers can hijack authenticated administrative sessions of CHARX SEC charging controllers and disrupt charging station availability.
Affected Products
- Phoenix Contact CHARX SEC-3000 and SEC-3000 firmware
- Phoenix Contact CHARX SEC-3050 and SEC-3050 firmware
- Phoenix Contact CHARX SEC-3100 / SEC-3100 firmware and CHARX SEC-3150 / SEC-3150 firmware
Discovery Timeline
- 2024-05-14 - CVE-2024-28134 published to the National Vulnerability Database (NVD)
- 2025-01-23 - Last updated in NVD database
Technical Details for CVE-2024-28134
Vulnerability Analysis
The CHARX SEC web-based management interface transmits session tokens without sufficient transport protection. An adversary on the same network path, such as an attacker on a shared LAN segment or a compromised upstream device, can passively observe HTTP traffic between an administrator and the controller. Captured session tokens can be replayed against the management interface to impersonate the authenticated user.
The scope of access depends on the privileges of the hijacked session. Read operations expose only non-sensitive information, but write operations targeting charging configuration or operational state can disrupt service. The high attack complexity reflects the prerequisite of network positioning between the user and the device.
Root Cause
The root cause is cleartext transmission of authentication material as described by CWE-319: Cleartext Transmission of Sensitive Information. The web management channel does not consistently enforce encrypted transport or bind session tokens to additional client attributes that would defeat replay.
Attack Vector
Exploitation proceeds in three stages. First, the attacker establishes a network position that allows interception of management traffic to the CHARX SEC device. Second, the attacker passively captures a session token issued to an authenticated operator. Third, the attacker injects the captured token into requests against the web management interface and acts with the original user's privileges. The vulnerability requires no prior authentication and no interaction from the legitimate user beyond their normal login activity. Full technical details are documented in the VDE Security Advisory VDE-2024-019.
Detection Methods for CVE-2024-28134
Indicators of Compromise
- Unexpected web management sessions originating from IP addresses outside the administrator workstation range.
- Concurrent active sessions sharing the same token from different source addresses.
- Configuration changes or availability disruptions on CHARX SEC controllers without a corresponding authorized change record.
Detection Strategies
- Inspect network captures between operator workstations and CHARX SEC devices for unencrypted HTTP traffic carrying session cookies or tokens.
- Alert on ARP spoofing, rogue DHCP responses, or unexpected gateway changes on operational technology (OT) network segments hosting charging infrastructure.
- Correlate web management authentication events with source IP allow lists for administrative access.
Monitoring Recommendations
- Continuously monitor OT segment traffic for plaintext credentials and session identifiers using passive network sensors.
- Forward CHARX SEC device logs to a centralized log platform and alert on session reuse from new source addresses.
- Track availability metrics of charging controllers and investigate unexplained reboots or service interruptions.
How to Mitigate CVE-2024-28134
Immediate Actions Required
- Restrict access to the CHARX SEC web management interface to a dedicated management VLAN reachable only by authorized engineering workstations.
- Require administrators to access charging controllers through a hardened jump host rather than directly from shared user networks.
- Review the VDE Security Advisory VDE-2024-019 and apply the firmware version recommended by Phoenix Contact.
Patch Information
Phoenix Contact and CERT@VDE coordinated the disclosure of this issue. Refer to VDE Security Advisory VDE-2024-019 for the fixed firmware versions for the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 controllers and apply the vendor-supplied update.
Workarounds
- Place CHARX SEC devices behind a segmented OT network with strict ingress and egress filtering to eliminate MitM positioning opportunities.
- Terminate administrator sessions immediately after use and avoid leaving long-lived authenticated browser sessions open.
- Deploy network access control to prevent unauthorized devices from joining segments that carry management traffic.
# Configuration example: restrict management access using host-based filtering
# Example iptables rule on an upstream gateway to limit who can reach CHARX SEC web UI
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.0.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.0.0/24 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 10.20.0.0/24 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
