An unauthenticated attacker can force the device to switch to a second RAUC firmware slot that contains insecure settings, including default credentials. Once the fallback occurs, the device’s SSH service permits login as the unprivileged user "user-app", allowing the attacker to remotely gain access to the system. This breach can lead to charging interruption and further compromise of device functions by an attacker who can execute commands with the privileges granted to that user.

The vulnerability affects Phoenix Contact's CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 product series. No specific firmware versions are listed in the CVE report, so all firmware releases for these models should be considered potentially vulnerable until an update is applied.

The CVSS score of 8.3 indicates a high severity impact, but the EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be remote unauthenticated, as the attacker only needs to trigger the fallback mechanism to obtain access using default credentials.