An unauthenticated remote attacker can inject malicious firmware because the JupiCore service transmits firmware updates without performing an integrity or verification check. This weakness, which corresponds to CWE-434, can compromise the integrity of the device and potentially provide the attacker with unauthorized control or additional attack vectors when chained with CVE-2026-44104.

The vulnerability affects Phoenix Contact’s JupiCore-enabled devices, specifically the CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, and CHARX SEC-3150 models. No specific firmware revisions are listed in the public data, so all revisions of these models are considered potentially vulnerable.

Based on the description, the likely attack vector is internal or on an unprotected network segment that can reach the JupiCore service. The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a low but nonzero likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Successful exploitation would give the attacker the ability to replace legitimate firmware with malicious code, jeopardizing device integrity and potentially enabling further compromise.