CVE-2026-44092 - Vulnerability Details

- Missing input validation / stripping of CRLF characters in SystemConfigManager

Description

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

Published: 2026-07-30

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ModbusServer application fails to validate or strip CRLF characters from data received via MQTT, which exposes CWE‑93 (input validation) and CWE‑94 (improper code execution) weaknesses. This missing input validation allows an unauthenticated attacker to inject arbitrary information. The injected payload can corrupt configuration or destabilize the server, causing loss of integrity or availability.

Affected Systems

The vulnerability compromises Phoenix Contact devices model CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, and CHARX SEC-3150. No specific firmware or software version is indicated, so any installed firmware on these models is potentially affected.

Risk and Exploitability

The CVSS score of 8.8 reflects high severity, while the EPSS score of less than 1% suggests exploitation is unlikely in the near term. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is through unauthenticated remote injection over the MQTT channel, where an attacker conveys crafted messages that the server does not sanitize.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Phoenix Contact

CHARX SEC-3150

unaffected

Version	Status	Constraints
`1.0.0`	affected	< 1.9.1

Phoenix Contact

CHARX SEC-3100

unaffected

Version	Status	Constraints
`1.0.0`	affected	< 1.9.1

Phoenix Contact

CHARX SEC-3050

unaffected

Version	Status	Constraints
`1.0.0`	affected	< 1.9.1

Phoenix Contact

CHARX SEC-3000

unaffected

Version	Status	Constraints
`1.0.0`	affected	< 1.9.1

No data.

Vendor Product Confidence Versions

Phoenixcontact

Charx Sec-3000

98%

Version	Status	Scheme	Platform
`[1.0.0,1.9.1)`	affected	semver	—

Phoenixcontact

Charx Sec-3050

98%

Version	Status	Scheme	Platform
`[1.0.0,1.9.1)`	affected	semver	—

Phoenixcontact

Charx Sec-3100

98%

Version	Status	Scheme	Platform
`[1.0.0,1.9.1)`	affected	semver	—

Phoenixcontact

Charx Sec-3150

98%

Version	Status	Scheme	Platform
`[1.0.0,1.9.1)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the vendor-supplied firmware update that resolves the input validation flaw identified as CWE‑93 and CWE‑94.
If an update is unavailable, enforce strict MQTT authentication and TLS to limit unauthorized data injection.
Configure firewalls or ACLs to reject MQTT traffic from untrusted IP ranges, ensuring only trusted hosts can reach the device.
When possible, modify the ModbusServer code to strip CRLF characters from all MQTT messages before processing to mitigate injection risk.

Generated by OpenCVE AI on August 9, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0038.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-44092
https://www.certvde.com/en/advisories/VDE-2026-008/
https://www.cve.org/CVERecord?id=CVE-2026-44092

History

Sun, 09 Aug 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-94
References		https://nvd.nist.gov/vuln/detail/CVE-2026-44092 https://www.cve.org/CVERecord?id=CVE-2026-44092
Metrics	threat_severity `None`	threat_severity `Critical`

Thu, 30 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Phoenixcontact Phoenixcontact charx Sec-3000 Phoenixcontact charx Sec-3050 Phoenixcontact charx Sec-3100 Phoenixcontact charx Sec-3150
Vendors & Products		Phoenixcontact Phoenixcontact charx Sec-3000 Phoenixcontact charx Sec-3050 Phoenixcontact charx Sec-3100 Phoenixcontact charx Sec-3150

Thu, 30 Jul 2026 07:15:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
Title		Missing input validation / stripping of CRLF characters in SystemConfigManager
First Time appeared		Phoenix Contact Phoenix Contact charx Sec 3000 Phoenix Contact charx Sec 3050 Phoenix Contact charx Sec 3100 Phoenix Contact charx Sec 3150
Weaknesses		CWE-93
CPEs		cpe:2.3:o:phoenix_contact:charx_sec_3000:::::::: cpe:2.3:o:phoenix_contact:charx_sec_3050:::::::: cpe:2.3:o:phoenix_contact:charx_sec_3100:::::::: cpe:2.3:o:phoenix_contact:charx_sec_3150::::::::
Vendors & Products		Phoenix Contact Phoenix Contact charx Sec 3000 Phoenix Contact charx Sec 3050 Phoenix Contact charx Sec 3100 Phoenix Contact charx Sec 3150
References		https://www.certvde.com/en/advisories/VDE-2026-008/
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Phoenix Contact Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 Charx Sec 3150

Phoenixcontact Charx Sec-3000 Charx Sec-3050 Charx Sec-3100 Charx Sec-3150

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2026-07-30T06:47:57.320Z

Updated: 2026-07-30T15:17:18.110Z

Reserved: 2026-05-05T10:48:08.226Z

Link: CVE-2026-44092

Vulnrichment

Updated: 2026-07-30T14:38:25.233Z

NVD

Status : Deferred

Published: 2026-07-30T07:16:57.110

Modified: 2026-07-30T16:17:11.620

Link: CVE-2026-44092

Redhat

Severity : Critical

Publid Date: 2026-07-30T06:47:57Z

Links: CVE-2026-44092 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-09T01:30:17Z

Weaknesses

CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object