Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-44098

OS Command Injection in OCPP Agent via charge_box_id

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Phoenix Contact CHARX SEC-3150

Default version status: unaffected

  • 1.0.0 to < 1.9.1affected

Phoenix Contact CHARX SEC-3100

Default version status: unaffected

  • 1.0.0 to < 1.9.1affected

Phoenix Contact CHARX SEC-3050

Default version status: unaffected

  • 1.0.0 to < 1.9.1affected

Phoenix Contact CHARX SEC-3000

Default version status: unaffected

  • 1.0.0 to < 1.9.1affected

References