CVE-2025-25271 HIGH

CVE-2025-25271: OCPP Backend Configuration via Insecure Defaults

Vendor Phoenix Contact

Product CHARX SEC-3150

Weakness CWE-1188

Published July 8, 2025

Last update July 22, 2025

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.

Key dates

02Disclosure timeline

July 8, 2025 CVE published

July 22, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-25271 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1188.html

Related vulnerabilities

Identifiers

CVE CVE-2025-25271

CWE CWE-1188

CVSS 8.8 / HIGH

Affected versions

Vendor Phoenix Contact

Product CHARX SEC-3150

Affected ≥ 0.0.0 and < 1.7.3

Vendor Phoenix Contact

Product CHARX SEC-3100

Affected ≥ 0.0.0 and < 1.7.3

Vendor Phoenix Contact

Product CHARX SEC-3050

Affected ≥ 0.0.0 and < 1.7.3

Vendor Phoenix Contact

Product CHARX SEC-3000

Affected ≥ 0.0.0 and < 1.7.3

CVE-2025-25271: OCPP Backend Configuration via Insecure Defaults

01Description

02Disclosure timeline

03References

04Related CVE