Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors.
view advisory published 2024-09-10
The pathfinder TCP encapsulation service is vulnerable to a drain of open file descriptors.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-7734US | — | — | ||
An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encap… | ||||
02
references
External citations — patches, advisories, analysis.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2024-052: Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors. - HTMLself
- Phoenix Contact PSIRTexternal
- VDE-2024-052: Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors. - CSAFself
03
remediations (2)
- Mitigation
If possible, access to the listen port of the pathfinder TCP encapsulation service should be limited to trustworthy networks or peers.
- Fixed
Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 8.9.3 / 10.4.1 or higher which fixes this vulnerability.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan