{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44092", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2026-05-05T10:48:08.226Z", "datePublished": "2026-07-30T06:47:57.320Z", "dateUpdated": "2026-07-30T15:17:18.110Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CHARX SEC-3150", "vendor": "Phoenix Contact", "versions": [{"lessThan": "1.9.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3100", "vendor": "Phoenix Contact", "versions": [{"lessThan": "1.9.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3050", "vendor": "Phoenix Contact", "versions": [{"lessThan": "1.9.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "CHARX SEC-3000", "vendor": "Phoenix Contact", "versions": [{"lessThan": "1.9.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenix_contact:charx_sec_3150:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.9.1", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenix_contact:charx_sec_3100:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.9.1", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenix_contact:charx_sec_3050:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.9.1", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenix_contact:charx_sec_3000:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.9.1", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "ZDI"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.</p>"}], "value": "An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-07-30T06:47:57.320Z"}, "references": [{"url": "https://www.certvde.com/en/advisories/VDE-2026-008/"}], "source": {"advisory": "VDE-2026-008", "defect": ["CERT@VDE#641939"], "discovery": "UNKNOWN"}, "title": "Missing input validation / stripping of CRLF characters in SystemConfigManager", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T14:38:20.576283Z", "id": "CVE-2026-44092", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T15:17:18.110Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44092", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T14:38:20.576283Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T14:38:25.233Z"}}], "cna": {"title": "Missing input validation / stripping of CRLF characters in SystemConfigManager", "source": {"defect": ["CERT@VDE#641939"], "advisory": "VDE-2026-008", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "ZDI"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Phoenix Contact", "product": "CHARX SEC-3150", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Phoenix Contact", "product": "CHARX SEC-3100", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Phoenix Contact", "product": "CHARX SEC-3050", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Phoenix Contact", "product": "CHARX SEC-3000", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.certvde.com/en/advisories/VDE-2026-008/"}], "x_generator": {"engine": "Vulnogram 0.4.0"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.", "supportingMedia": [{"type": "text/html", "value": "<p>An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:phoenix_contact:charx_sec_3150:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.9.1", "versionStartIncluding": "1.0.0"}], "operator": "OR"}], "operator": "OR"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:phoenix_contact:charx_sec_3100:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.9.1", "versionStartIncluding": "1.0.0"}], "operator": "OR"}], "operator": "OR"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:phoenix_contact:charx_sec_3050:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.9.1", "versionStartIncluding": "1.0.0"}], "operator": "OR"}], "operator": "OR"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:phoenix_contact:charx_sec_3000:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.9.1", "versionStartIncluding": "1.0.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-07-30T06:47:57.320Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44092", "state": "PUBLISHED", "dateUpdated": "2026-07-30T15:17:18.110Z", "dateReserved": "2026-05-05T10:48:08.226Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2026-07-30T06:47:57.320Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.2"}

{}

{}