CVE-2025-24005: Charx SEC-3000 Privilege Escalation Flaw

CVE-2025-24005 Overview

CVE-2025-24005 is a local privilege escalation vulnerability affecting Phoenix Contact CHARX SEC electric vehicle charging controllers. A local attacker who already holds a low-privileged user account can invoke a vulnerable script over SSH and escalate to root because of improper input validation ([CWE-20]). The flaw exists in the firmware of the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 product lines. Phoenix Contact CHARX controllers are deployed in public and private EV charging infrastructure, making authenticated access to these devices a realistic pivot point for attackers targeting operational technology environments. Details were published in CERT-VDE Advisory VDE-2025-014.

Critical Impact
A local user with SSH access can obtain root privileges on the charging controller, gaining full control of the device firmware and any connected charging session logic.

Affected Products

Phoenix Contact CHARX SEC-3000 and SEC-3050 (firmware and hardware)
Phoenix Contact CHARX SEC-3100 and SEC-3150 (firmware and hardware)
Deployments exposing SSH management access to any non-root local account

Discovery Timeline

2025-07-08 - CVE-2025-24005 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24005

Vulnerability Analysis

The vulnerability resides in a privileged helper script accessible to authenticated local users via SSH on CHARX SEC controllers. The script accepts user-supplied input without proper validation and executes with elevated privileges. An attacker with any valid local account can supply crafted arguments to the script and reach a code path that runs as root. Because the CHARX SEC firmware runs the EV charging control logic, root access permits tampering with charging sessions, firmware components, network configuration, and log integrity. The advisory classifies the issue as improper input validation [CWE-20]. See CERT-VDE Advisory VDE-2025-014 for vendor-supplied technical detail.

Root Cause

The root cause is missing or insufficient validation of arguments passed to a privileged script exposed to non-root users. Because the script runs with elevated rights (for example via sudo rules or setuid semantics), unsanitized input flows into a privileged execution context. This pattern typically enables command injection, path manipulation, or option-parsing abuse that pivots the caller into a root shell or root-owned file write.

Attack Vector

Exploitation requires local access with valid credentials and network reachability to the SSH service. After authenticating, the attacker invokes the vulnerable script with attacker-controlled arguments. The script fails to reject or sanitize dangerous input and performs a privileged action on behalf of the attacker. No user interaction and no additional privileges beyond the initial low-privileged account are required. No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list.

No verified exploitation code is available. Refer to the CERT-VDE advisory for vendor guidance on the affected script and firmware versions.

Detection Methods for CVE-2025-24005

Indicators of Compromise

SSH sessions from low-privileged local accounts followed by process activity running as uid=0 on CHARX SEC devices.
Unexpected invocations of vendor helper scripts with unusual argument strings, shell metacharacters, or path traversal sequences.
New or modified files under root-owned directories, unexpected cron entries, or persistence artifacts written after a non-root SSH login.

Detection Strategies

Forward SSH authentication logs and shell audit trails from CHARX controllers to a central log platform and alert on privilege transitions from non-root to root.
Baseline the expected command set for each local account and flag deviations, particularly executions of privileged administrative scripts.
Correlate SSH login events with subsequent configuration or firmware changes on the same device within a short time window.

Monitoring Recommendations

Enable verbose auditing (auditd or equivalent) on the controller if supported, focusing on execve calls to the vulnerable script path.
Monitor SSH access lists and disable dormant local accounts that could be used as a foothold.
Track firmware version inventory across the CHARX SEC fleet to confirm patched builds are deployed everywhere.

How to Mitigate CVE-2025-24005

Immediate Actions Required

Apply the firmware update referenced in CERT-VDE Advisory VDE-2025-014 to all CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 devices.
Restrict SSH access to trusted management networks using firewall rules or VPN segmentation.
Rotate credentials for all local accounts on CHARX controllers and remove unused accounts.

Patch Information

Phoenix Contact addresses the flaw through a firmware update coordinated with CERT@VDE. Consult the vendor advisory for exact fixed firmware versions and download locations before deployment. Stage the update in a maintenance window because CHARX controllers are field-deployed charging infrastructure and may require session drain and reboot.

Workarounds

Disable SSH on production CHARX SEC devices where remote shell administration is not required.
Limit local account provisioning to a minimum operator set and enforce strong, unique credentials.
Place charging controllers behind an OT-aware firewall that restricts inbound management traffic to a bastion or jump host.

bash

# Example: restrict SSH to a management subnet on an upstream firewall
# (adjust interface and subnet to match your environment)
iptables -A INPUT -p tcp --dport 22 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP