This vulnerability involves the insertion of sensitive information, specifically the credentials of the local user "user-app", into log files in Phoenix Contact CHARX SEC-3150 version 1.0.0. An attacker with local access and low privileges who can read these logs may use the exposed credentials to authenticate via SSH as "user-app", which could lead to disruption of charging operations. The CVSS 4.0 base score is 5.8, reflecting a medium severity with local attack vector, low complexity, and partial impact on confidentiality, integrity, and availability.

The exposure of local user credentials in log files can allow a low-privileged local attacker to gain authenticated SSH access as the "user-app" user. This access may enable disruption of charging operations managed by the device. The impact is limited to local attackers with access to the logs and affects confidentiality, integrity, and availability at a limited level.

No official patch or remediation level is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to log files to trusted users only to prevent unauthorized reading of sensitive credentials.