Cyber Resilience

CVE-2024-26000

Medium

Published: 12 March 2024

Published
12 March 2024
Modified
24 January 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0018 39.2th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-26000 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Phoenixcontact Charx Sec-3000 Firmware. Its CVSS base score is 5.9 (Medium).

Operationally, ranked at the 39.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.

CWE(s)
CWE-125

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

phoenixcontact
charx sec-3000 firmware
≤ 1.5.1
phoenixcontact
charx sec-3050 firmware
≤ 1.5.1
phoenixcontact
charx sec-3100 firmware
≤ 1.5.1
phoenixcontact
charx sec-3150 firmware
≤ 1.5.1

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References