CVE-2026-44090

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - info@cert.vde.com

Published

2026-07-30

Last modified

2026-07-30

Weaknesses

CWE-306

Affected products

• Charx Sec 3000 (Phoenix Contact)
• Charx Sec 3050 (Phoenix Contact)
• Charx Sec 3100 (Phoenix Contact)
• Charx Sec 3150 (Phoenix Contact)

References

• https://www.certvde.com/en/advisories/VDE-2026-008/