PHOENIX CONTACT: mGuard Device Manager affected by HTTP Request Smuggling of Apache Webserver
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling. For the mGuard Device Manager only the mdm Installer for Windows is affected.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-22720US | critical9.8 | Exploit | ||
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling | ||||
references
External citations — patches, advisories, analysis.
- VDE-2022-014: PHOENIX CONTACT: mGuard Device Manager affected by HTTP Request Smuggling of Apache Webserver - HTMLself
- CERT@VDE Security Advisories for PHOENIX CONTACTexternal
- PHOENIX CONTACT PSIRTexternal
- VDE-2022-014: PHOENIX CONTACT: mGuard Device Manager affected by HTTP Request Smuggling of Apache Webserver - CSAFself
remediations (2)
- MitigationFirmware <=1.13.0.1 installed on FL MGUARD DM UNLIMITED
This vulnerability is exploitable only if the ConfigPull functionality is used and config files are stored unencrypted. As a best practice and mitigation measure, we recommend storing configuration files encrypted with the device specific public key of the mGuard appliances.
- FixedFirmware <=1.13.0.1 installed on FL MGUARD DM UNLIMITED
PHOENIX CONTACT strongly recommends upgrading FL MGUARD DM UNLIMITED to version 1.13.0.2 or higher, which fixes this vulnerability.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan