Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers

An attacker with network access to a CHARX SEC charging controller could execute arbitrary commands or modify charging parameters without authentication, potentially disrupting EV charging operations or causing physical equipment damage.

This affects facilities operating Phoenix Contact CHARX SEC-3xxx charging controllers for EV charging stations. Water utilities with EV fleet charging infrastructure and municipal electric utilities with public charging networks should prioritize updates. Charging station operators and facilities managers responsible for EV infrastructure are most directly impacted.

An attacker on the network sends a crafted command to the controller's network interface. The device lacks proper input validation and authentication controls, allowing the attacker to execute operating system commands or alter charging logic directly.