CVE-2025-24006: Charx Sec-3000 Privilege Escalation Flaw

CVE-2025-24006 Overview

CVE-2025-24006 is a local privilege escalation vulnerability affecting Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 electric vehicle charging controllers. A low-privileged local attacker with Secure Shell (SSH) access can leverage insecure file or directory permissions on affected devices to escalate privileges to root. The weakness is categorized under Improper Privilege Management [CWE-269]. Successful exploitation grants full administrative control over the charging controller, allowing the attacker to modify firmware behavior, alter charging operations, and pivot within operational technology (OT) networks.

Critical Impact
Authenticated attackers with SSH access to affected CHARX SEC devices can gain root privileges, resulting in complete compromise of confidentiality, integrity, and availability of the charging controller.

Affected Products

Phoenix Contact CHARX SEC-3000 and CHARX SEC-3050 firmware
Phoenix Contact CHARX SEC-3100 and CHARX SEC-3150 firmware
All CHARX SEC-3000 series charging controller hardware variants

Discovery Timeline

2025-07-08 - CVE-2025-24006 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24006

Vulnerability Analysis

The vulnerability resides in the permission model applied to files, directories, or executables accessible through SSH on CHARX SEC charging controllers. A local user account authenticated via SSH can interact with resources that hold overly permissive access rights. These insecure permissions allow the low-privileged user to modify, replace, or execute components that run in the context of the root account.

Because CHARX SEC devices are deployed as OT endpoints in electric vehicle charging infrastructure, a compromised controller can influence power delivery, billing telemetry, and communication with backend charge point operator systems. Attackers gaining root can persist, disable monitoring, and use the device as a foothold to attack adjacent industrial networks.

Root Cause

The root cause is improper privilege management [CWE-269]. Files or executables reachable by a low-privileged SSH user carry permissions that permit write access or privileged execution paths without proper authorization checks. When those resources are invoked or loaded by root-owned processes, the attacker's supplied content executes with elevated rights.

Attack Vector

Exploitation requires local access with valid low-privileged SSH credentials on the target device. No user interaction is required, and attack complexity is low. Once authenticated, the attacker abuses the insecure permissions to plant or modify content that is subsequently executed with root privileges. Refer to the CERT@VDE Security Advisory VDE-2025-014 for vendor-provided technical detail.

Detection Methods for CVE-2025-24006

Indicators of Compromise

Unexpected SSH logins from service or low-privileged accounts on CHARX SEC controllers, particularly from unfamiliar source addresses.
New or modified files in system directories with mismatched ownership or timestamps inconsistent with firmware updates.
Processes running as root that were spawned from user-writable paths or by non-root parent processes.

Detection Strategies

Audit filesystem permissions on affected devices to identify world-writable files, setuid binaries, and directories owned by non-root users but executed by privileged services.
Correlate SSH authentication logs with subsequent privilege-changing events such as su, sudo, or unexpected uid=0 process creations.
Monitor outbound network activity from CHARX SEC controllers for anomalous connections that may indicate post-exploitation command and control.

Monitoring Recommendations

Forward device syslog and authentication events to a centralized SIEM or data lake for baseline comparison and long-term retention.
Alert on any configuration or firmware changes to CHARX SEC devices outside of approved change windows.
Track SSH session duration and command history for low-privileged accounts to detect enumeration of permission weaknesses.

How to Mitigate CVE-2025-24006

Immediate Actions Required

Apply the firmware update published by Phoenix Contact as referenced in advisory VDE-2025-014.
Restrict SSH access to CHARX SEC devices to trusted management networks and administrative jump hosts only.
Rotate credentials for all local accounts on affected controllers and disable any unused service accounts.

Patch Information

Phoenix Contact and CERT@VDE published coordinated guidance for this issue. Consult the CERT@VDE Security Advisory VDE-2025-014 for the exact fixed firmware versions and upgrade instructions for the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 product lines.

Workarounds

Disable SSH on affected controllers where remote shell access is not operationally required.
Segment CHARX SEC devices into a dedicated OT network zone with strict firewall rules blocking lateral access from user endpoints.
Enforce multi-factor authentication or key-based SSH access using strong, unique keys managed through a central identity system.

bash

# Configuration example: restrict SSH exposure at the network perimeter
# Allow SSH only from a defined management subnet, drop all other sources
iptables -A INPUT -p tcp --dport 22 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP