This vulnerability (CVE-2026-44102) involves a race condition (CWE-362) in the Phoenix Contact CHARX SEC-3150 device firmware version 1.0.0. An unauthenticated attacker can remotely initiate a firmware update download by supplying an invalid firmware file through the OCPP backend interface. The improper locking mechanism during the cleanup phase causes the invalid firmware file to remain accessible for a short time before it is deleted, potentially exposing sensitive data or allowing other unintended interactions with the file.

The impact is that an unauthenticated remote attacker can cause an invalid firmware file to remain accessible temporarily on the device, which may lead to unauthorized access to the file or related resources during that window. The vulnerability does not require privileges or user interaction and has a medium severity rating (CVSS 6.9). There is no indication of further escalation or persistent compromise from the provided data.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, monitor vendor communications for updates. No vendor advisory content indicates that the issue is mitigated or no action is required.