PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series

published 2024-05-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-25281

cvss: 7.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-05-14)

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

PHOENIX CONTACT CHARX SEC-3000
PHOENIX CONTACT CHARX SEC-3050
PHOENIX CONTACT CHARX SEC-3100
PHOENIX CONTACT CHARX SEC-3150
phoenixcontact charx_sec_3000
phoenixcontact charx_sec_3100
phoenixcontact charx_sec_3150
phoenixcontact charx_sec_3050

Classification

Weakness

CWE-319 Cleartext Transmission of Sensitive Information

References

cert.vde.com /en/advisories/VDE-2024-019
third-party-advisory

Sources

CVE List CVE-2024-28134
NVD CVE-2024-28134

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary