{"id":14095,"date":"2026-03-02T08:08:00","date_gmt":"2026-03-02T06:08:00","guid":{"rendered":"https:\/\/www.phoenixcontact-emobility.com\/?p=14095"},"modified":"2026-03-03T09:07:11","modified_gmt":"2026-03-03T07:07:11","slug":"pwn2own-automotive-2026-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.phoenixcontact-emobility.com\/en\/news-and-events\/charging-infrastructure\/pwn2own-automotive-2026-cybersecurity\/","title":{"rendered":"Pwn2Own Automotive 2026: Cybersecurity for our charging solutions"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Phoenix Contact was once again represented at the renowned Pwn2Own Automotive 2026<\/a> security competition in Tokyo this year. For the third time in a row, the AC charging controller CHARX control modular<\/a> was nominated as an official target device \u2013 a clear sign of the technical significance and security quality that our products are accorded in the international research community.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

2026 was also a special year: for the first time, Robin Pape, Product & Solution Security Expert (PSSE), accompanied the competition on site. He observed the attempts against our controller, analyzed attack chains, and ensured clean, responsible documentation throughout the coordinated disclosure process for the further development of our cybersecurity processes at Phoenix Contact E-Mobility.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Why Pwn2Own is different from traditional security tests <\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Pwn2Own differs significantly from traditional security tests.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t

\n\t\t\t\tIn contrast to a regular penetration test, in which individual teams work with a clearly defined task, here several highly specialized security researcher teams compete against each other, each using completely different methods and approaches to compromise our charging controller.\t\t\t<\/p>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\u2013 Robin Pape, Product & Solution Security Expert<\/cite>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/blockquote>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In addition, the competition rules provide strong incentives to search as deeply as possible for unknown attack vectors: “The Pwn2Own rules, which award less prize money for vulnerabilities found multiple times , incentivize security researchers to explore different attack vectors and ‘dig deep’ in order to find vulnerabilities that may have been overlooked by other teams.” <\/strong><\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This structure makes the Pwn2Own event one of the most valuable platforms worldwide for gaining new security-related insights for your own products.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

High level of professionalism among security researchers <\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The live demonstrations in Tokyo impressively showed how precisely and carefully the research teams work. Many arrived with complete attack chains for several target devices. This shows that without intensive preparation, a spontaneous, targeted attack on the target devices in this year’s competition would not have been possible at all.<\/p>

\u00a0<\/p>

Robin sums up the professionalism of the event as follows: “I had the impression that the teams were all very well prepared. Most of them had exploits for multiple targets in their luggage. A lot of preparation time went into this. The findings were not random hits, but the result of highly professional work by talented and experienced security researchers.”<\/em><\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Lab mode instead of reality \u2013 and still extremely valuable<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

“The AC charging controller CHARX control modular<\/a> was used in ‘lab mode’ at Pwn2Own. This means it was set up openly with direct access to all interfaces, which is very different from normal use in a charging station. The setup therefore does not correspond to the reality in the field. Certain features were deliberately activated in advance. These are disabled by default in normal operation and are actually only intended for configuration purposes.”<\/strong><\/em> \u2013 Robin Pape<\/p>

This confirms that the requirements at Pwn2Own go beyond normal field conditions, but precisely for this reason provide extremely valuable insights for our Product & Solution Security Expert Robin Pape.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Positive feedback and new ideas from the community <\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The feedback on how vulnerabilities found in previous years were handled was particularly gratifying. Both the security researchers and Trend Micro<\/a> praised Phoenix Contact’s professionalism, transparency, and responsiveness in this regard.<\/p>

“We were able to take away many valuable suggestions that will be incorporated into the further improvement of the cybersecurity of our products \u2013 so that we are well equipped to deal with threats in the future.”<\/strong><\/em> \u2013 Robin Pape<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Conclusion: A competition that makes us stronger<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Participation in Pwn2Own Automotive 2026 once again confirms the value of collaboration with the global security community.<\/p>

We gain early insight into potential vulnerabilities, continuously improve our security architecture, and strengthen the robustness of our products \u2013 long before threats become relevant in the field. The issues identified are incorporated into a structured analysis and solution process. In accordance with Phoenix Contact’s established cybersecurity processes, we will provide updates via the CERT@VDE<\/a> platform.<\/p>

We are grateful for the open exchange with the TrendAI Zero Day Initiative\u00a0(ZDI<\/a>) and the many strong market players who were also present. Special thanks go to the creativity and perseverance of security researchers from around the world. Together, we are able to stand up for safe mobility and continue to drive it forward.
One thing is also clear: our products are technically top-of-the-line. And we take every opportunity to improve them further.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
FAQ<\/h5>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Frequently asked questions<\/h2>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\n\t\t\t\t\t

What is the Pwn2Own Automotive competition? <\/h3><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Pwn2Own Automotive is an internationally recognized security competition in which security researchers attempt to attack connected vehicles, charging infrastructure, and automotive components in a targeted manner. The aim is to uncover previously unknown vulnerabilities in order to improve the cybersecurity of products at an early stage. The 2026 competition took place in Tokyo, Japan.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t

Why does Phoenix Contact participate in Pwn2Own Automotive? <\/h3><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Phoenix Contact uses Pwn2Own Automotive to have its charging solutions tested under extremely demanding conditions. Several independent, highly specialized teams attack our charging controller \u2013 much more intensively than in a classic penetration test. This gives us early indications of possible vulnerabilities and allows us to continuously improve the security of our products and processes.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t

Is the test setup at Pwn2Own realistic for use in the field? <\/h3><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The charging controller is tested in what is known as lab mode: openly structured, with direct access to all interfaces. In addition, some functions are activated that are deactivated in regular charging station operation or are only used for configuration. The setup is therefore deliberately more stringent than real field conditions \u2013 but that is precisely why it provides particularly in-depth security-related insights.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t