The CHARX OCPP Agent service in Phoenix Contact CHARX SEC-3150 version 1.0.0 does not enforce authentication on a critical function that manages backend connection configuration. This missing authentication (CWE-306) enables unauthenticated remote attackers to alter backend settings, which can lead to denial-of-service conditions and unauthorized disclosure of sensitive information. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can remotely and without authentication reconfigure the backend connection of the CHARX SEC-3150 device. This can disrupt service availability (denial-of-service) and expose confidential data to the attacker, compromising the device's security and potentially affecting connected systems relying on it.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the CHARX OCPP Agent service to trusted entities only and monitor for unauthorized configuration changes if possible.