A flaw in the execution order of shutdown scripts causes the firewall to terminate prematurely, creating a brief window where internal services may be exposed to the external network. This weakness is categorized as CWE-696, indicating that security controls were not correctly enforced. An attacker could exploit this temporary exposure to connect to internal services without authentication, which could lead to complete takeover of the compromised system. The impact is therefore catastrophic for confidentiality, integrity, and availability of the affected devices.

Phoenix Contact security controllers named CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, and CHARX SEC-3150 are affected. The advisory does not provide specific firmware or version ranges; consequently all models listed by the vendor that employ the described shutdown functionality are considered vulnerable. Version or firmware details would refine the scope, but they are not supplied.

The CVSS score of 9.3 signals a critical vulnerability, while the EPSS score of less than 1 % indicates a low probability of exploitation at the moment. The vulnerability is not catalogued in CISA’s KEV list. The likely exploitation scenario is a remote, unauthenticated attacker connecting to internal services during the window when the firewall is inactive. Timing of the connection is essential, suggesting that passive network monitoring during shutdown could detect such attempts.