CVE-2026-44092: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') in Phoenix Contact CHARX SEC-3150
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2026-44092 involves improper neutralization of CRLF sequences (CWE-93) in the ModbusServer application of the Phoenix Contact CHARX SEC-3150 device. The application does not validate input fetched from MQTT, allowing an unauthenticated remote attacker to inject malicious input. This injection can cause integrity and availability issues within the system. The vulnerability affects version 1.0.0 of the product. The CVSS 4.0 base score is 8.8, indicating high severity, with network attack vector, no privileges or user interaction required, and high impact on integrity and availability.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to inject malicious CRLF sequences into the ModbusServer application via MQTT input, potentially causing loss of data integrity and system availability in the CHARX SEC-3150 device version 1.0.0.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published. Until a patch is available, restrict network access to the affected device and monitor MQTT input sources to mitigate potential exploitation.
CVE-2026-44092: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') in Phoenix Contact CHARX SEC-3150
Description
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
CVSS v4.0
Score 8.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-44092 involves improper neutralization of CRLF sequences (CWE-93) in the ModbusServer application of the Phoenix Contact CHARX SEC-3150 device. The application does not validate input fetched from MQTT, allowing an unauthenticated remote attacker to inject malicious input. This injection can cause integrity and availability issues within the system. The vulnerability affects version 1.0.0 of the product. The CVSS 4.0 base score is 8.8, indicating high severity, with network attack vector, no privileges or user interaction required, and high impact on integrity and availability.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to inject malicious CRLF sequences into the ModbusServer application via MQTT input, potentially causing loss of data integrity and system availability in the CHARX SEC-3150 device version 1.0.0.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published. Until a patch is available, restrict network access to the affected device and monitor MQTT input sources to mitigate potential exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERTVDE
- Date Reserved
- 2026-05-05T10:48:08.226Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6afbbf9c2644c7f8b7233a
Added to database: 07/30/2026, 07:22:39 UTC
Last enriched: 07/30/2026, 07:40:39 UTC
Last updated: 07/31/2026, 02:51:53 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.