This vulnerability (CWE-434) affects Phoenix Contact CHARX SEC-3150 version 1.0.0. It permits a remote attacker with operator privileges to upload arbitrary files via a REST API endpoint designed for firmware updates. The flaw allows the attacker to store files persistently on the device, which may result in resource exhaustion and denial-of-service. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited impact on confidentiality and integrity but some impact on availability. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

An attacker with operator-level remote access can upload arbitrary files, which are stored persistently on the device. This can lead to resource exhaustion and potentially cause denial-of-service conditions, impacting device availability. There is no indication of direct confidentiality or integrity compromise beyond the file upload capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict operator access to trusted users only and monitor for unusual file uploads or resource usage. Avoid exposing the firmware update REST endpoint to untrusted networks.