Phoenix Contact: Two vulnerabilities in the jq JSON processor utilized by FL MGUARD 110x devices
The jq JSON processor, which is used to migrate firmware configurations in the product, contains 2 vulnerabilities that can be exploited by an authenticated attacker.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-48060US | high7.5 | Exploit | ||
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-f… | ||||
| CVE-2024-23337US | medium6.5 | — | ||
jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit.… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2025-077: Phoenix Contact: Two vulnerabilities in the jq JSON processor utilized by FL MGUARD 110x devices - HTMLself
- PCSA-2025/00016external
- VDE-2025-077: Phoenix Contact: Two vulnerabilities in the jq JSON processor utilized by FL MGUARD 110x devices - CSAFself
Behebungen (2)
- Behoben
Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 1.8.1 or higher which fixes this vulnerability.
- Behoben
Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 1.8.1 or higher which fixes this vulnerability.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan