CVE-2024-6788
Phoenixcontact Charx Sec-3000 Firmware ≤ 1.6.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HSummary
CVE-2024-6788 is a high-severity Use of Default Credentials (CWE-1392) vulnerability in Phoenixcontact Charx Sec-3000 Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A remote unauthenticated attacker can exploit a weakness in the firmware update feature on the LAN interface of the affected device to reset the password of the predefined low-privileged account “user-app” back to its default value. The issue is tracked as CVE-2024-6788 with a CVSS 3.1 score of 8.6 and is associated with CWE-1392. No specific product names or software versions are identified in the available details beyond the device exposing this interface.
An attacker with network access to the LAN interface requires no authentication or user interaction to perform the password reset. Successful exploitation grants the attacker the ability to log in as the “user-app” account, resulting in limited confidentiality and integrity impacts combined with high availability impact on the device.
The primary reference is the VDE advisory VDE-2024-022, which security practitioners should consult for any vendor-specific mitigation steps or patches. The EPSS score reached a peak of 0.0546 after disclosure before receding to its current value of 0.0388, indicating limited but observable post-disclosure interest that has since declined.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47818
Vulnerability Data
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.2.1
Mitigating Controls (NIST 800-53 r5) AI
Secure configuration settings establish baselines that prohibit default credentials on system components.
Authenticator management requires verification of identity and secure distribution of initial authenticators, directly stopping default credentials from being left in place.
Vulnerability scanning can discover default credentials after deployment but does not stop their introduction.
Account management processes include assignment and control of initial account credentials, reducing the chance defaults remain active.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and configuration management explicitly prohibit default credentials on deployed systems.
Credential management processes directly require replacing or disabling default passwords and keys.
Authentication policies can enforce non-default credential strength but do not explicitly address initial deployment defaults.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The requirement to replace vendor default authentication information immediately after installation directly counters the use of default credentials that attackers commonly target.