CVE-2025-25270: Charx Sec-3000 Firmware RCE Vulnerability

CVE-2025-25270 Overview

CVE-2025-25270 is a critical firmware vulnerability affecting Phoenix Contact CHARX SEC series EV charging controllers. An unauthenticated remote attacker can alter the device configuration in a way that leads to remote code execution as root under specific configurations. This vulnerability represents a severe threat to electric vehicle charging infrastructure, potentially allowing complete device compromise without any authentication.

Critical Impact

Unauthenticated attackers can achieve root-level remote code execution by manipulating device configurations, leading to complete device takeover with full administrative privileges.

Affected Products

• Phoenix Contact CHARX SEC-3000 (Firmware)
• Phoenix Contact CHARX SEC-3050 (Firmware)
• Phoenix Contact CHARX SEC-3100 (Firmware)
• Phoenix Contact CHARX SEC-3150 (Firmware)

Discovery Timeline

• 2025-07-08 - CVE-2025-25270 published to NVD
• 2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-25270

Vulnerability Analysis

This vulnerability is classified under CWE-913 (Improper Control of Dynamically-Managed Code Resources), indicating that the affected Phoenix Contact CHARX SEC devices fail to properly restrict or validate modifications to their configuration that can subsequently influence code execution. The attack can be executed remotely over the network without requiring any authentication or user interaction.

The vulnerability affects the firmware of Phoenix Contact's CHARX SEC series of EV charging controllers, which are industrial devices used in electric vehicle charging infrastructure. The ability to achieve root-level code execution without authentication presents a significant risk to critical infrastructure deployments.

Root Cause

The root cause stems from improper control of dynamically-managed code resources (CWE-913). The device configuration mechanism lacks adequate access controls and validation, allowing unauthenticated remote attackers to modify settings in ways that can be leveraged for arbitrary code execution. This represents a fundamental design flaw in how the device handles configuration changes and their subsequent impact on system behavior.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker with network access to vulnerable CHARX SEC devices can exploit this vulnerability by sending specially crafted requests to alter the device configuration. Under specific configurations, these modifications can be leveraged to achieve remote code execution with root privileges on the underlying system.

The vulnerability mechanism involves manipulating device configuration parameters that are not properly validated or access-controlled. When certain configuration changes are applied, they can result in the execution of attacker-controlled code with the highest system privileges. For detailed technical information, refer to the CERT@VDE Advisory VDE-2025-019.

Detection Methods for CVE-2025-25270

Indicators of Compromise

• Unexpected configuration changes on CHARX SEC devices, particularly those affecting system execution paths
• Unauthorized network connections originating from charging controller devices
• Anomalous processes running with root privileges on affected firmware
• Log entries showing configuration modifications from external or unexpected IP addresses

Detection Strategies

• Monitor network traffic to CHARX SEC devices for unauthorized configuration change requests
• Implement network segmentation monitoring to detect lateral movement from compromised charging infrastructure
• Deploy IDS/IPS rules to identify exploitation attempts targeting Phoenix Contact device management interfaces
• Regularly audit device configurations against known-good baselines to detect unauthorized modifications

Monitoring Recommendations

• Enable comprehensive logging on all CHARX SEC devices and forward logs to a centralized SIEM
• Implement network traffic analysis for anomalous communication patterns from EV charging infrastructure
• Monitor for outbound connections from charging controllers to unexpected destinations
• Set up alerts for configuration changes performed outside of scheduled maintenance windows

How to Mitigate CVE-2025-25270

Immediate Actions Required

• Isolate affected CHARX SEC devices from untrusted networks immediately
• Implement network segmentation to restrict access to charging controller management interfaces
• Review device configurations for any unauthorized or suspicious modifications
• Apply vendor-provided firmware updates as soon as they become available

Patch Information

Phoenix Contact has released information regarding this vulnerability. Organizations should consult the CERT@VDE Advisory VDE-2025-019 for detailed remediation guidance and firmware update information. Coordinate with Phoenix Contact support to obtain and apply the latest security patches for CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, and CHARX SEC-3150 devices.

Workarounds

• Place all CHARX SEC devices behind firewalls and restrict network access to trusted management stations only
• Disable remote configuration capabilities if not required for operational purposes
• Implement VPN requirements for any remote administrative access to charging infrastructure
• Enable authentication mechanisms where available and configure strong access controls

# Network isolation configuration example (firewall rules)
# Restrict access to CHARX SEC management interface to trusted management subnet only
# Consult your firewall documentation for specific syntax
# Example: Allow only 192.168.100.0/24 management network access to device
# iptables -A INPUT -s 192.168.100.0/24 -d <CHARX_SEC_IP> -j ACCEPT
# iptables -A INPUT -d <CHARX_SEC_IP> -j DROP