The vulnerability is a missing authentication mechanism in the MQTT broker. An unauthenticated remote attacker can connect and communicate with the broker, which is the only exposed service guarded by a firewall. This flaw allows the attacker to issue commands to the device, potentially leading to full compromise of the endpoint. The weakness corresponds to CWE-306, improper authentication.

Affected systems are Phoenix Contact’s CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 series. Firmware version details are not supplied, but the issue is present across all four product families.

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of less than 1% suggests that exploitation is currently rare. However, the vulnerability is not in the CISA KEV catalog, meaning no public exploits are known. The likely attack vector is remote over the network: an attacker who gains any level of remote network access (or compromising an internal host) can reach the broker and bypass authentication, taking complete control of the device. Due to the high severity, the impact remains significant even if the exploitation probability remains low.