EV charger firmware flaws: what operators need to act on

TL;DR: Firmware 1.9.1 for Phoenix Contact CHARX SEC-3xxx EV charging controllers fixes 20 vulnerabilities, including exposed services, privilege escalation from limited accounts, and weak firmware update handling that could enable broader compromise across connected charging environments, according to VicOne. Patch verification and network restriction matter because device integrity depends on more than remediation alone.

Editorial analysis by NHI Mgmt Group, based on content published by VicOne: “20 Phoenix Contact CHARX Vulnerabilities Patched: How They Could Have Enabled Deeper EV Charger Control”.

Key questions

Q: What fails when EV charging controllers expose unauthenticated services?

A: Unauthenticated services turn a managed device into an exposed control surface.

Q: Why do limited accounts become dangerous on embedded controllers?

A: Because restricted local access often sits closer to root than teams expect.

Q: What are the signs that firmware update trust is failing?

A: Look for unsigned or unexpectedly accepted images, repeated update retries, unexplained cleanup behaviour, and firmware changes that cannot be tied to an authorised maintenance process.

Practitioner guidance

• Install firmware 1.9.1 and verify the running version Apply the corrected firmware to affected CHARX SEC-3xxx controllers, then confirm the installed version after restart so the remediation is not assumed rather than verified.
• Constrain controllers to closed industrial networks Place MQTT, OCPP, Modbus, management, and firmware-update services behind a suitable firewall and limit reachability to authorised systems and users only.
• Review configuration and reboot anomalies Watch for unexpected configuration changes, firmware downloads, repeated reboots, and charging interruptions, because these are the operational signals most consistent with attempted exploitation.

Bottom line: The advisory shows that EV charger compromise can start with exposed services, move through privilege escalation, and end in device or environment-level disruption.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →