The vulnerability resides in the system configuration and allows a local user with limited privileges to inject a password into pppd, enabling arbitrary command execution as root. This results in full system compromise and is identified as a CWE-78 command injection weakness.

Affected vendors and products include Phoenix Contact's CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, and CHARX SEC-3150. Precise version information is not provided in the available data, so all current firmware releases for these models should be reviewed for patches.

With a CVSS score of 8.5 the vulnerability is considered high severity, yet its EPSS score of less than 1% indicates a low probability of exploitation. It is not listed in the CISA KEV catalog. The attack vector is local, requiring physical or local network access to the affected device and exploiting the ability of non‑administrative users to inject commands into pppd.