This vulnerability in Phoenix Contact CHARX SEC-3150 devices (version 1.0.0) allows remote attackers to perform OS command injection due to improper neutralization of special elements in OS commands (CWE-78). Although authentication is nominally required, it can be bypassed, allowing unauthenticated remote code execution. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, no user interaction, and high impact on availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation can lead to arbitrary code execution on affected devices, potentially compromising device integrity and availability. The vulnerability allows attackers to bypass authentication and execute commands remotely, posing a high risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to affected devices and monitor for suspicious activity related to command injection attempts.