A local privilege escalation flaw exists in the /etc/init.d/user-applications init script. The flaw enables a low-privileged local user to execute arbitrary system commands with root privileges, providing full control over the affected device. This vulnerability is a classic example of CWE-78, where unsanitized input is passed to the shell for execution.

The product family impacted is Phoenix Contact’s CHARX SEC line, specifically the SEC–3000, SEC–3050, SEC–3100 and SEC–3150 models. No specific firmware or software version details were supplied, so the entire family is considered at risk until further information is released.

The CVSS score of 8.5 indicates a high severity for unauthorized privilege escalation. The EPSS score is under 1%, suggesting that while the risk to confidentiality, integrity, and availability is severe, the likelihood of exploitation at this time is low. The flaw is not listed in CISA’s KEV, and the attack vector is local: a compromised or already logged-in low-privileged user can trigger the init script to elevate to root. Mitigation therefore hinges on local preventive measures or an official patch from Phoenix Contact.