PHOENIX CONTACT: FL MGUARD affected by two vulnerabilities
The FL MGUARD family of devices is affected by two vulnerabilities.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-2673US | — | — | ||
Improper Input Validation vulnerability in PHOENIX CONTACT FL/TC MGUARD Family in multiple versions may allow UDP packets to bypass the filter rules and access the solely connected… | ||||
| CVE-2022-4304US | medium5.9 | Exploit | ||
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack.… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- Mitigation
Do not use RSA based ciphers for encryption of network traffic, use cipher suites with forward secrecy for TLS or IPsec communication and renew vulnerable certificates frequently. Configure the incoming IPv4 packet filter carefully to protect clients from potentially malicious UDP packets.
- Mitigation
Do not use RSA based ciphers for encryption of network traffic, use cipher suites with forward secrecy for TLS or IPsec communication and renew vulnerable certificates frequently. Configure the incoming IPv4 packet filter carefully to protect clients from potentially malicious UDP packets.
- Behoben
The vulnerabilities are fixed in firmware versions 8.9.1 and 10.2.0. We strongly recommend all affected FL MGUARD users to upgrade to this or a later version.
- Behoben
The vulnerabilities are fixed in firmware versions 8.9.1 and 10.2.0. We strongly recommend all affected FL MGUARD users to upgrade to this or a later version.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan