This vulnerability (CVE-2026-44098) affects Phoenix Contact CHARX SEC-3150 version 1.0.0 and involves improper neutralization of special elements in OS commands (CWE-78), enabling unauthenticated remote attackers with OCPP backend control via firewall bypass to perform OS command injection. Successful exploitation allows execution of arbitrary commands as the limited user charx-oa, potentially interrupting charging functionality. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with high impact on availability and moderate impact on confidentiality and integrity. No vendor remediation or patch is currently documented.

An unauthenticated remote attacker can execute arbitrary OS commands on the affected device as the limited user charx-oa by exploiting this vulnerability. This can lead to disruption of charging services, impacting availability. Confidentiality and integrity impacts are rated low to moderate. There is no indication of privilege escalation beyond the limited user or of direct cloud service involvement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the OCPP backend to prevent unauthorized control and firewall bypass. Monitor for unusual activity related to command execution on the device. No official patch or workaround has been published by the vendor at this time.