The firmware of Phoenix Contact CHARX SEC‑3xxx charging controllers allows an unauthenticated attacker on the same local network to download controller log files. This flaw reveals restricted information, such as configuration, usage patterns or potentially sensitive data, and is classified as an information exposure (CWE‑200). The vulnerability does not grant system control but can significantly compromise confidentiality by leaking operational details.

Affected devices are the Phoenix Contact CHARX SEC‑3000, SEC‑3050, SEC‑3100 and SEC‑3150 series charging controllers. The issue exists in their firmware, and the advisory does not limit impact to a particular firmware revision, so all current releases are potentially vulnerable.

With a CVSS score of 7.5 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, so the current exploitation probability is unknown. The attacker must be physically or logically adjacent, typically on the same LAN segment, to trigger the exploit and download logs without authentication. Successful exploitation leads to information disclosure that could enable further attacks such as credential harvesting or targeted compromise.