Affected: Phoenix Contact CHARX SEC-3150, Phoenix Contact CHARX SEC-3100, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3000

A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.

An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog. An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.

A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.

A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.