CVE-2025-25268

Published: Jul 8, 2025Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: info@cert.vde.com (Secondary)

Description

An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.

Affected (4)

Products: Phoenixcontact: Charx Sec 3000 Firmware, Charx Sec 3050 Firmware, Charx Sec 3100 Firmware, Charx Sec 3150 Firmware

Phoenixcontact

4 products

Charx Sec 3000 Firmware

Charx Sec 3050 Firmware

Charx Sec 3100 Firmware

Charx Sec 3150 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Charx Sec 3000 Firmware	Before 1.7.3

Running on/with	Platform Versions
Phoenixcontact Charx Sec 3000	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Charx Sec 3050 Firmware	Before 1.7.3

Running on/with	Platform Versions
Phoenixcontact Charx Sec 3050	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Charx Sec 3100 Firmware	Before 1.7.3

Running on/with	Platform Versions
Phoenixcontact Charx Sec 3100	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phoenixcontact Charx Sec 3150 Firmware	Before 1.7.3

Running on/with	Platform Versions
Phoenixcontact Charx Sec 3150	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://certvde.com/de/advisories/VDE-2025-019

Source: info@cert.vde.com

Third Party Advisory

Timeline

No history available yet.