This vulnerability in Phoenix Contact CHARX SEC-3150 (version 1.0.0) arises from improper neutralization of special elements in the init-script for user-applications, enabling a local user with limited privileges to execute arbitrary OS commands with root privileges. This results in a full system compromise. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no attack prerequisites, and high impact on confidentiality, integrity, and availability. No vendor-provided remediation or patch information is available, and the product is not a cloud service, so remediation depends on vendor updates or workarounds.

A low-privileged local user can escalate privileges to root by exploiting this vulnerability, resulting in complete control over the affected system. This can lead to unauthorized access, modification, or destruction of data and system resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to trusted personnel only and monitor for suspicious local activity. Avoid running untrusted user applications on affected systems.