9.1
CVE-2026-44092
- EPSS 0.38%
- Veröffentlicht 30.07.2026 07:16:57
- Zuletzt bearbeitet 30.07.2026 16:17:11
- CVE-Watchlists
- Unerledigt
Missing input validation / stripping of CRLF characters in SystemConfigManager
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPhoenix Contact
≫
Produkt
CHARX SEC-3150
Default Statusunaffected
Version
1.0.0
Version <
1.9.1
Status
affected
HerstellerPhoenix Contact
≫
Produkt
CHARX SEC-3100
Default Statusunaffected
Version
1.0.0
Version <
1.9.1
Status
affected
HerstellerPhoenix Contact
≫
Produkt
CHARX SEC-3050
Default Statusunaffected
Version
1.0.0
Version <
1.9.1
Status
affected
HerstellerPhoenix Contact
≫
Produkt
CHARX SEC-3000
Default Statusunaffected
Version
1.0.0
Version <
1.9.1
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.38% | 0.307 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| info@cert.vde.com | 8.8 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| info@cert.vde.com | 9.1 | 3.9 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
|
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
https://www.certvde.com/en/advisories/VDE-2026-008/