This vulnerability (CVE-2026-44106) affects Phoenix Contact CHARX SEC-3150 version 1.0.0 and involves improper neutralization of special elements used in OS commands (CWE-78), enabling local privilege escalation. An attacker must first execute low-privileged code locally to exploit this OS command injection flaw. The CVSS 4.0 base score is 8.5, indicating high severity, with attack vector local, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation allows a local attacker with low privileges to escalate their privileges on the affected device, potentially gaining higher-level control. This could compromise the confidentiality, integrity, and availability of the system. Since exploitation requires prior low-privileged code execution, the vulnerability is not remotely exploitable without initial access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users and monitor for unauthorized local code execution attempts. No official patch or workaround has been published at this time.