CVE-2024-6788

Published: Aug 13, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.

Affected (4)

Products: Phoenixcontact: Charx Sec 3000 Firmware, Charx Sec 3050 Firmware, Charx Sec 3100 Firmware, Charx Sec 3150 Firmware

Phoenixcontact

4 products

Charx Sec 3000 Firmware

Charx Sec 3050 Firmware

Charx Sec 3100 Firmware

Charx Sec 3150 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Charx Sec 3000 Firmware	Before 1.6.3

Running on/with	Platform Versions
Phoenixcontact Charx Sec 3000	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Charx Sec 3050 Firmware	Before 1.6.3

Running on/with	Platform Versions
Phoenixcontact Charx Sec 3050	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Charx Sec 3100 Firmware	Before 1.6.3

Running on/with	Platform Versions
Phoenixcontact Charx Sec 3100	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Charx Sec 3150 Firmware	Before 1.6.3

Running on/with	Platform Versions
Phoenixcontact Charx Sec 3150	All versions

Related CWEs

CWE-1392

Use of Default Credentials

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

References (1)

https://cert.vde.com/en/advisories/VDE-2024-022

Source: info@cert.vde.com

Third Party Advisory

Timeline

No history available yet.