The vulnerability identified as CVE-2026-44097 affects Phoenix Contact CHARX SEC-3150 version 1.0.0. It involves an unrestricted file upload flaw (CWE-434) in the REST endpoint used for firmware updates. An attacker with operator-level privileges can upload arbitrary files, which are stored persistently. This may lead to resource exhaustion and denial-of-service. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and low privileges required. No official fix or patch has been documented in the vendor advisory or related sources.

An attacker with operator privileges can upload arbitrary files to the device, potentially filling storage and exhausting resources, which may cause denial-of-service. The vulnerability does not require user interaction and can be exploited remotely over the network. The impact is rated medium severity with a CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict operator access to trusted users only and monitor usage of the firmware update REST endpoint to detect abnormal file uploads. Avoid exposing the device management interface to untrusted networks.