This vulnerability (CVE-2026-44096) in Phoenix Contact CHARX SEC-3150 devices arises from improper neutralization of special elements used in OS commands (CWE-78), enabling local attackers who already have low-privileged code execution to escalate privileges. The CVSS 4.0 vector indicates low attack vector (local), low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The affected version explicitly identified is 1.0.0. No vendor advisory or patch information is currently provided.

An attacker with local low-privileged code execution can exploit this vulnerability to escalate privileges, potentially gaining higher system access. This can compromise the confidentiality, integrity, and availability of the affected device. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to privilege escalation attempts.