Topic starter
25/10/2026 11:00 am
TL;DR: The update fixed 20 Phoenix Contact CHARX SEC-3xxx flaws, including 19 reported through Pwn2Own Automotive 2026, according to VicOne. EV charger operators still need to verify firmware, limit service reachability, and narrow account scope because patching alone leaves trust gaps.
Editorial analysis by NHI Mgmt Group, based on content published by VicOne: “20 Phoenix Contact CHARX Vulnerabilities Patched: How They Could Have Enabled Deeper EV Charger Control”.
Key questions
Q: Why do limited accounts become dangerous on embedded controllers?
A: Because restricted local access often sits closer to root than teams expect.
Q: What are the signs that firmware update trust is failing?
A: Look for unsigned or unexpectedly accepted images, repeated update retries, unexplained cleanup behaviour, and firmware changes that cannot be tied to an authorised maintenance process.
Q: What fails when EV charging controllers expose unauthenticated services?
A: Unauthenticated services turn a managed device into an exposed control surface.
Practitioner guidance
- Install firmware 1.9.1 and verify the running version Apply the corrected firmware to affected CHARX SEC-3xxx controllers, then confirm the installed version after restart so the remediation is not assumed rather than verified.
- Constrain controllers to closed industrial networks Place MQTT, OCPP, Modbus, management, and firmware-update services behind a suitable firewall and limit reachability to authorised systems and users only.
- Review configuration and reboot anomalies Watch for unexpected configuration changes, firmware downloads, repeated reboots, and charging interruptions, because these are the operational signals most consistent with attempted exploitation.
Bottom line: The advisory shows that EV charger compromise can start with exposed services, move through privilege escalation, and end in device or environment-level disruption.
Glossary terms: Firmware Integrity, Privilege Escalation, Service Account, Closed Industrial Network
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
These findings are best understood as control-plane failures, not isolated bugs. The article shows three recurring paths: unauthenticated service access, local privilege escalation, and weak firmware integrity. That combination matters because each path weakens a different trust boundary in the same device stack. For operators, the practical lesson is that charger security depends on how identity, access, and update trust are governed together, not on patching one layer in isolation.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should operators reduce the blast radius of EV charger compromise?
A: They should combine patching with hard network segmentation, strict service reachability, and continuous monitoring of controller behaviour. The goal is to prevent a single device flaw from becoming a broader trust problem across management systems or backend services. That requires treating the charger as part of a connected environment with explicit access boundaries, not as an isolated appliance.
👉 Read our full editorial: EV charger firmware flaws expose privilege and update weaknesses
This post was modified 7 days ago by NHI Mgmt Group