A low‑privileged remote attacker with operator‑level rights can exploit the firmware update REST endpoint to upload malicious files. This flaw allows persistent storage of attacker‑controlled data and can consume storage or computational resources, potentially causing a denial of service. The weakness corresponds to CWE‑434.

Phoenix Contact devices CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, and CHARX SEC-3150 are affected. The vulnerability resides in the firmware update REST endpoint, but specific firmware versions are not identified in the available data.

The CVSS score of 5.3 classifies the flaw as medium severity; the EPSS score is below 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need operator‑level credentials and access to the REST endpoint, but no elevated privileges or additional permissions are required beyond those normally granted to operators.