CHARX SEC-3000/3050/3100/3150 Firmware Vulnerabilities Advisory (CVE-2025-24003, CVE-2025-24005, CVE-2025-24006)

Key Information Vulnerability ID VDE-2025-014 Release and Update Time Release Date: 2025-07-08 09:00 (CEST) Last Updated: 2025-07-08 08:58 (CEST) Affected Products and Versions Vulnerability Details CVE-2025-24003: CVSS Score 8.2 CVE-2025-24005: CVSS Score 7.8 CVE-2025-24006: CVSS Score 7.8 CVE-2025-24002: CVSS Score 5.3 CVE-2025-24004: CVSS Score 5.2 Impact The vulnerabilities may lead to complete loss of confidentiality, integrity, and availability of the devices. Remediation Mitigation: It is recommended to use affected charging controllers within isolated industrial networks and protect them with appropriate firewalls. Fix Recommendation: It is strongly recommended to upgrade to firmware version 1.7.3 to address CVE-2025-24005 and CVE-2025-24006. For CVE-2025-24002, CVE-2025-24003, and CVE-2025-24004, which affect the Eichrecht feature in firmware versions <= 1.6.5, there is currently no vendor fix planned. Reporters Jesson Soto Ventura and Matthew Waddell from ivision.

Goal Reached Thanks to every supporter — we hit 100%!

CHARX SEC-3000/3050/3100/3150 Firmware Vulnerabilities Advisory (CVE-2025-24003, CVE-2025-24005, CVE-2025-24006)