The CHARX OCPP Agent service omits authentication checks, allowing an unauthenticated attacker to send reconfiguration commands that alter the backend connection settings. This flaw is an instance of CWE‑306 (Missing Authentication) and permits the attacker to interrupt normal operation or reveal sensitive configuration data, resulting in service disruption and potential data exposure.

Phoenix Contact’s CHARX SEC‑3000, SEC‑3050, SEC‑3100, and SEC‑3150 devices are impacted. The CVE data does not specify affected firmware or software versions, so all current releases should be considered vulnerable until a patch is applied.

The vulnerability is classified with a CVSS score of 9.3, indicating critical impact. However, the EPSS score of less than 1% suggests that exploitation in the wild is currently very unlikely, and the flaw is not listed in the CISA KEV catalog. The attack vector is remote and unauthenticated; an attacker only needs network access to the CHARX OCPP Agent service. A successful exploit could terminate services and expose confidential configuration data, but no known public exploits have been reported.