An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0.

Published 8 y ago 2018-01-30 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.3%

percentile 21%

Public exploits

none known

An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing an attacker to modify firmware update packages.

Exploit prediction (EPSS)

0.28% probability of exploitation in the next 30 days, higher than 21% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.8	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	4.6	`AV:L/AC:L/Au:N/C:P/I:P/A:P`

Affected products

n/a PHOENIX CONTACT mGuard

Classification

Weakness

CWE-354 Improper Validation of Integrity Check Value
CWE-20 Improper Input Validation

References

securityfocus.com /bid/102907 · vdb-entry, x_refsource_BID, x_transferred
ics-cert.us-cert.gov /advisories/ICSA-18-030-01 · x_refsource_MISC, x_transferred
cert.vde.com /en-us/advisories/vde-2018-001 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-5441
NVD: CVE-2018-5441

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.