CVE-2025-24002 Overview
CVE-2025-24002 is a denial-of-service vulnerability affecting Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 charging controllers used in electric vehicle charging stations that comply with German Calibration Law. An unauthenticated remote attacker can send crafted Message Queuing Telemetry Transport (MQTT) messages to crash a service on the affected device. The crash triggers a temporary denial-of-service condition until the watchdog restarts the affected component. The vulnerability is tracked under [CWE-20: Improper Input Validation] and is documented in CERT-VDE Advisory VDE-2025-014.
Critical Impact
Remote unauthenticated attackers can interrupt EV charging station availability by sending malicious MQTT messages, disrupting calibrated billing and charging operations until watchdog-triggered recovery completes.
Affected Products
- Phoenix Contact CHARX SEC-3000 and SEC-3000 firmware
- Phoenix Contact CHARX SEC-3050 and SEC-3050 firmware
- Phoenix Contact CHARX SEC-3100 / SEC-3150 and associated firmware
Discovery Timeline
- 2025-07-08 - CVE-2025-24002 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-24002
Vulnerability Analysis
The CHARX SEC series controllers expose an MQTT service that processes messages required for coordinating charging operations under German Calibration Law (Eichrecht). The affected service does not properly validate the structure or content of inbound MQTT messages. An attacker who can reach the MQTT interface over the network can submit a malformed message that causes the service to terminate unexpectedly.
Once the service crashes, the device enters a temporary denial-of-service state. A watchdog mechanism restarts the affected process, but the charging station remains unavailable until recovery completes. Repeated exploitation can produce sustained service disruption on production charging infrastructure.
Root Cause
The root cause is improper input validation ([CWE-20]) inside the MQTT message-handling code path. The service fails to sanitize or bound-check message fields before processing, leading to an unhandled condition that terminates the process. No authentication is required to trigger the flaw, because the vulnerable code executes before any application-layer authorization takes place.
Attack Vector
Exploitation requires network reachability to the MQTT service on an affected CHARX SEC controller. An attacker sends one or more crafted MQTT publish messages targeting the vulnerable topic handler. No user interaction, credentials, or elevated privileges are required. Because charging stations are frequently deployed in semi-public networks or reachable via operator backends, the exposure surface can extend beyond the local network.
No verified proof-of-concept code has been published. Refer to the CERT-VDE Advisory VDE-2025-014 for vendor-provided technical details.
Detection Methods for CVE-2025-24002
Indicators of Compromise
- Unexpected restarts of MQTT-handling services on CHARX SEC-3000, SEC-3050, SEC-3100, or SEC-3150 controllers
- Watchdog reboot events correlated with inbound MQTT traffic from untrusted sources
- Gaps or resets in charging session logging or calibration records tied to the affected devices
Detection Strategies
- Monitor MQTT broker logs for malformed publish packets, oversized payloads, or unusual topic patterns directed at CHARX controllers
- Alert on repeated service crash or watchdog-triggered reset events reported by CHARX SEC device telemetry
- Correlate network flow data with device availability metrics to identify DoS patterns targeting TCP/1883 or TCP/8883
Monitoring Recommendations
- Baseline normal MQTT traffic volume and topic distribution per charging site to expose anomalies quickly
- Forward device syslog and watchdog events to a central SIEM for continuous availability monitoring
- Track uptime metrics for each CHARX controller and alert on repeated unplanned restarts within short windows
How to Mitigate CVE-2025-24002
Immediate Actions Required
- Consult CERT-VDE Advisory VDE-2025-014 and apply the firmware update supplied by Phoenix Contact for the affected CHARX SEC models
- Restrict network access to the MQTT service so that only trusted backend systems can publish to charging controllers
- Inventory all deployed CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 units and validate their firmware versions against the advisory
Patch Information
Phoenix Contact has published remediation guidance through CERT@VDE. Operators should follow the fixed firmware versions and configuration recommendations listed in CERT-VDE Advisory VDE-2025-014 for each affected CHARX SEC model.
Workarounds
- Place CHARX SEC controllers behind a firewall or VPN that limits MQTT reachability to authorized management hosts only
- Segment charging station networks from corporate and public networks using VLANs or dedicated OT security gateways
- Enable authentication and TLS on the MQTT broker where supported, and block anonymous publish access at the network layer
- Configure rate limiting on upstream network devices to reduce the impact of repeated malformed MQTT messages
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
