vulnwire
8.1high

CVE-2024-43390

Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devices

Published 2 y ago · modified 4 mo ago · JSON

CVSS
8.1
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 44%
Public exploits
0
none known

A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction (EPSS)

0.52% probability of exploitation in the next 30 days, higher than 44% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.18.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA3.18.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA3.18.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

  • PHOENIX CONTACT FL MGUARD 2102
  • PHOENIX CONTACT FL MGUARD 2105
  • PHOENIX CONTACT FL MGUARD 4102 PCI
  • PHOENIX CONTACT FL MGUARD 4102 PCIE
  • PHOENIX CONTACT FL MGUARD 4302
  • PHOENIX CONTACT FL MGUARD 4305
  • PHOENIX CONTACT FL MGUARD CENTERPORT VPN-1000
  • PHOENIX CONTACT FL MGUARD CORE TX
  • PHOENIX CONTACT FL MGUARD CORE TX VPN
  • PHOENIX CONTACT FL MGUARD DELTA TX/TX
  • PHOENIX CONTACT FL MGUARD DELTA TX/TX VPN
  • PHOENIX CONTACT FL MGUARD GT/GT
  • PHOENIX CONTACT FL MGUARD GT/GT VPN
  • PHOENIX CONTACT FL MGUARD PCI4000
  • PHOENIX CONTACT FL MGUARD PCI4000 VPN
  • PHOENIX CONTACT FL MGUARD PCIE4000
  • PHOENIX CONTACT FL MGUARD PCIE4000 VPN
  • PHOENIX CONTACT FL MGUARD RS2000 TX/TX-B
  • PHOENIX CONTACT FL MGUARD RS2000 TX/TX VPN
  • PHOENIX CONTACT FL MGUARD RS2005 TX VPN
  • PHOENIX CONTACT FL MGUARD RS4000 TX/TX
  • PHOENIX CONTACT FL MGUARD RS4000 TX/TX-M
  • PHOENIX CONTACT FL MGUARD RS4000 TX/TX-P
  • PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN
  • PHOENIX CONTACT FL MGUARD RS4004 TX/DTX
  • PHOENIX CONTACT FL MGUARD RS4004 TX/DTX VPN
  • PHOENIX CONTACT FL MGUARD SMART2
  • PHOENIX CONTACT FL MGUARD SMART2 VPN
  • PHOENIX CONTACT TC MGUARD RS2000 3G VPN
  • PHOENIX CONTACT TC MGUARD RS2000 4G ATT VPN
  • PHOENIX CONTACT TC MGUARD RS2000 4G VPN
  • PHOENIX CONTACT TC MGUARD RS2000 4G VZW VPN
  • PHOENIX CONTACT TC MGUARD RS4000 3G VPN
  • PHOENIX CONTACT TC MGUARD RS4000 4G ATT VPN
  • PHOENIX CONTACT TC MGUARD RS4000 4G VPN
  • PHOENIX CONTACT TC MGUARD RS4000 4G VZW VPN

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.