This vulnerability in Phoenix Contact CHARX SEC-3150 devices arises from the ModbusServer application's failure to validate input properly. An unauthenticated remote attacker can exploit this flaw to inject malicious input, bypassing firewall protections. The vulnerability has been assigned a high severity rating by ZDI and is characterized by a CVSS 4.0 vector indicating network attack vector, no user interaction, and no privileges required. No known exploits are reported in the wild, and no patch or remediation guidance is currently available.

An attacker can remotely inject malicious input into the ModbusServer application without authentication, potentially bypassing firewall rules. This could lead to unauthorized actions or disruptions on affected devices. The vulnerability affects network-adjacent attackers and does not require user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, organizations should consider network-level controls to restrict access to the ModbusServer application and monitor for unusual activity related to Modbus communications.