CVE-2026-44096

HighCVSS 7.8/10Last modified Jul 31, 2026

Description

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Phoenix Contact	CHARX SEC-3150	>= 1.0.0, < 1.9.1
Phoenix Contact	CHARX SEC-3100	>= 1.0.0, < 1.9.1
Phoenix Contact	CHARX SEC-3050	>= 1.0.0, < 1.9.1
Phoenix Contact	CHARX SEC-3000	>= 1.0.0, < 1.9.1

References

https://www.certvde.com/en/advisories/VDE-2026-008/

Timeline

Published: Jul 30, 2026
Last modified: Jul 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-440977.1A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resu CVE-2026-440988.6This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command CVE-2026-440997.8A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, r CVE-2026-44107.5IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Applica CVE-2026-441009.4The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging CVE-2026-441019.8Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. CVE-2026-441025.3An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This w CVE-2026-441035.3An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits fi CVE-2026-441049.8The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature CVE-2026-441056.6The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access CVE-2026-441067.8A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary comman CVE-2026-441077.5A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enab