CVE-2024-6788

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.

Score

CVSS 3.1 9.8 Critical

Status

Modified - info@cert.vde.com

Published

2024-08-13

Last modified

2025-08-22

Weaknesses

CWE-1392

Affected products

• Charx Sec-3000 (Phoenix Contact)
• Charx Sec-3050 (Phoenix Contact)
• Charx Sec-3100 (Phoenix Contact)
• Charx Sec-3150 (Phoenix Contact)
• Charx Sec-3000 Firmware (Phoenixcontact)
• Charx Sec-3050 Firmware (Phoenixcontact)
• Charx Sec-3100 Firmware (Phoenixcontact)
• Charx Sec-3150 Firmware (Phoenixcontact)
• Charx Sec 3000 (Phoenixcontact)
• Charx Sec 3050 (Phoenixcontact)
• Charx Sec 3100 (Phoenixcontact)
• Charx Sec 3150 (Phoenixcontact)

References

• https://cert.vde.com/en/advisories/VDE-2024-022