This vulnerability (CVE-2026-41032) affects Phoenix Contact CHARX SEC-3150 version 1.0.0. It allows an unauthenticated attacker with adjacent network access to download controller log files. These logs may contain sensitive information, leading to unauthorized exposure. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No official patch or remediation level has been published yet.

An attacker can access sensitive information by downloading controller log files without authentication or privileges. This exposure could lead to information disclosure that may aid further attacks or compromise confidentiality. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device to trusted users and networks only, especially limiting adjacent network access. Monitor for unusual access attempts to the device's log files.