Description
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Phoenix Contact CHARX SEC-3150
Default version status: unaffected
1.0.0 to < 1.9.1affected
Phoenix Contact CHARX SEC-3100
Default version status: unaffected
1.0.0 to < 1.9.1affected
Phoenix Contact CHARX SEC-3050
Default version status: unaffected
1.0.0 to < 1.9.1affected
Phoenix Contact CHARX SEC-3000
Default version status: unaffected
1.0.0 to < 1.9.1affected