PHOENIX CONTACT: mGuard <8.8.3 products missing initialization of resource
For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource (CWE-909).
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-12523US | critical9.1 | — | ||
On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integra… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
Instead of deactivating by configuration, network cables should be detached from affected switch ports.
- Fixed
Mitigation Instead of deactivating by configuration, network cables should be detached from affected switchports. Solution PHOENIX CONTACT recommends all mGuard users to upgrade to the firmware version 8.8.3.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan