PHOENIX CONTACT: Denial-of-Service vulnerability in mGuard product family
A denial of service of the HTTPS management interface of PHOENIX CONTACT FL MGUARD and TC MGUARD devices can be triggered by a larger number of unauthenticated HTTPS connections originating from different source IP's. Configuring firewall limits for incoming connections cannot prevent the issue.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3480US | — | — | ||
A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger number of unauthentica… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
Don't allow access to the HTTPS management interface from untrusted networks.In the default configuration, the access is only allowed from internal interfaces.
- Fixed
The vulnerability is fixed in firmware version 8.9.0. We strongly recommend all affected users to upgrade to this or a later version.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan