5.0
Medium
CVE-2024-28135 A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code…
Description
A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CHARX SEC-3000 1.5 | earliest → 1.5.1 | No fix stated |
| CHARX SEC-3050 1.5 | earliest → 1.5.1 | No fix stated |
| CHARX SEC-3100 1.5 | earliest → 1.5.1 | No fix stated |
| CHARX SEC-3150 1.5 | earliest → 1.5.1 | No fix stated |
| charx_sec_3050 1.5 | earliest → 1.5.1 | No fix stated |
| charx_sec_3100 1.5 | earliest → 1.5.1 | No fix stated |
| charx_sec_3000 1.5 | earliest → 1.5.1 | No fix stated |
| charx_sec_3150 1.5 | earliest → 1.5.1 | No fix stated |
Other CVEs of CHARX SEC-3000
The 51 CVEs of CHARX SEC-3000 →
CVE-2026-7849
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command…
9.3
Critical
CVE-2026-44108
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system…
9.3
Critical
CVE-2026-44107
A reboot of the charging controller can be triggered via Modbus TCP without authentication
8.7
High
CVE-2026-44105
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local…
5.8
Medium