SB20260731176 - Multiple vulnerabilities in Phoenix Contact controllers

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260731176

SB20260731176 - Multiple vulnerabilities in Phoenix Contact controllers

Published: July 31, 2026

Security Bulletin ID SB20260731176
CSH Severity
High
Patch available
YES
Number of vulnerabilities 20
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 55% Medium 15% Low 30%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 20 vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2026-44106)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the user-applications script. A local user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Race condition (CVE-ID: CVE-2026-44102)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a race condition. A remote attacker can trigger a firmware update download and cause the file to remain accessible for a short period before it is deleted.


3) Arbitrary file upload (CVE-ID: CVE-2026-44103)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the firmware-update endpoint. A remote attacker can upload a malicious file and execute it on the server.


4) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-44105)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to software stores sensitive information into log files. A local user can authenticate via SSH and gain access to the system.


5) Arbitrary file upload (CVE-ID: CVE-2026-44097)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the update2-upload endpoint. A remote user can upload a malicious file and execute it on the server.


6) Exposed dangerous method or function (CVE-ID: CVE-2026-44107)

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the exposure of a dangerous function within the CharxModbusServer. A remote attacker can perform a denial of service (DoS) attack.


7) OS Command Injection (CVE-ID: CVE-2026-44093)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the user-applications script. A local user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) OS Command Injection (CVE-ID: CVE-2026-44095)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the charx_set_ip_address binary. A local user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


9) OS Command Injection (CVE-ID: CVE-2026-44096)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the sudo rules in udhcpc. A local user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


10) OS Command Injection (CVE-ID: CVE-2026-44099)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the CharxSystemConfigManager service. A local user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


11) Command Injection (CVE-ID: CVE-2026-7849)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation within the CharxSystemConfigManager service. A remote attacker can pass specially crafted data to the application and execute arbitrary commands.


12) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-44094)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to compromise the targe system.

The vulnerability exists due to insecure recovery mechanism logic within the Robust Auto-Update Controller. A remote attacker can gain SSH access to the system.


13) OS Command Injection (CVE-ID: CVE-2026-44098)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the handling of log files. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


14) Trust Boundary Violation (CVE-ID: CVE-2026-44091)

CWE-ID: CWE-501 - Trust Boundary Violation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to trust boundary violation within the MQTT service. A remote attacker can post a malicious ID to the MQTT Broker and create new configuration entry in the system configuration.


15) CRLF injection (CVE-ID: CVE-2026-44092)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data within the charx-system-config-manager service. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.


16) Missing Authentication for Critical Function (CVE-ID: CVE-2026-44100)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication for critical function within the charx-jupicore REST API. A remote attacker can bypass authentication process and gain unauthorized access to the application.


17) Missing Authentication for Critical Function (CVE-ID: CVE-2026-44090)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication for critical function within the CharxModbusServer. A remote attacker can bypass authentication process and gain unauthorized access to the application.


18) Missing Authentication for Critical Function (CVE-ID: CVE-2026-44101)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication for critical function within the export-import endpoint. A remote attacker can bypass authentication process and gain unauthorized access to the application.


19) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-44104)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper verification of cryptographic signature within the CharxControllerAgent binary. A remote attacker can install a modified firmware and execute arbitrary code on the system.


20) Incorrect behavior order (CVE-ID: CVE-2026-44108)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to a flaw in the execution order of scripts during shutdown within the handling of firewall rules. A remote attacker can gain access to the target system.


Remediation

Install update from vendor's website.

References