Log in Start free

Vulnerability · Published Jul 30, 2026 · Assigned by CERTVDE

CVE-2026-44103JupiCore does not perform validation of firmware

Medium 5.3

In plain English

A medium-severity unrestricted file upload in CHARX SEC-3000 from Phoenix Contact. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 66.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.

Affected products (as reported)

VendorProductVersions
Phoenix Contact CHARX SEC-3150 1.0.0 – before 1.9.1
Phoenix Contact CHARX SEC-3100 1.0.0 – before 1.9.1
Phoenix Contact CHARX SEC-3050 1.0.0 – before 1.9.1
Phoenix Contact CHARX SEC-3000 1.0.0 – before 1.9.1

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References