CVE-2026-41032 Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers
Unauthenticated attackers can download log files from Phoenix Contact CHARX SEC charging controllers, potentially exposing restricted information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41032?
CVE-2026-41032 is a high-severity vulnerability in Phoenix Contact CHARX SEC-3000, published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.
Weakness: CWE-200
Which versions are affected by CVE-2026-41032?
How do I fix CVE-2026-41032?
No fix has been published for CVE-2026-41032 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-41032 being exploited?
There is no known exploitation of CVE-2026-41032 in the wild and no public exploit code.
Sources
Also known as GHSA-5hqw-c68q-v3hh.