ZDI-24-858: (Pwn2Own) Phoenix Contact CHARX SEC-3100 OCPP Protocol Missing Encryption Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2024-26288.

arbitrary code attackers authentication authentication bypass bypass bypass vulnerability code cve cve-2024 cves cvss devices encryption exploit missing network phoenix phoenix contact protocol pwn2own rating sec vulnerability zdi