VDE-2020-018 — PHOENIX CONTACT: FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT: PPPD vulnerable to CVE-2020-8597

Summary

FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT devices are affected by a buffer overflow vulnerability within the PPP service.

The PPP service is not active by default, but is used commonly at TC ROUTER, TC CLOUD CLIENT.
It is also running in the following FL MGUARD and TC MGUARD configurations:

• Mobile data connection
• Router mode "Modem"
• Router mode "PPPoE"
• L2TP over IPsec

Malicious PPP peers could try to exploit the vulnerability from remote.

Details

Impact
Attackers may either crash the PPP service or execute code with system permissions.

Remediation
PHOENIX CONTACT strongly recommends updating the devices to the latest firmware if the devices are used in configurations where PPPD is activated.

| Article No | Article | Affected Versions | Firmware Update |
|-------------:|:------------------------------|:------------------|:---------------------------------------------------------------------|
| 2200515 | FL MGUARD RS4000 TX/TX VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2200515/firmware_update) |
| 2700197 | FL MGUARD GT/GT | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2700197/firmware_update) |
| 2700198 | FL MGUARD GT/GT VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2700198/firmware_update) |
| 2700634 | FL MGUARD RS4000 TX/TX | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2700634/firmware_update) |
| 2700639 | FL MGUARD SMART2 VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2700639/firmware_update) |
| 2700640 | FL MGUARD SMART2 | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2700640/firmware_update) |
| 2700642 | FL MGUARD RS2000 TX/TX VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2700642/firmware_update) |
| 2700967 | FL MGUARD DELTA TX/TX | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2700967/firmware_update) |
| 2700968 | FL MGUARD DELTA TX/TX VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2700968/firmware_update) |
| 2701275 | FL MGUARD PCI4000 VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2701275/firmware_update) |
| 2701278 | FL MGUARD PCIE4000 VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2701278/firmware_update) |
| 2701875 | FL MGUARD RS2005 TX VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2701875/firmware_update) |
| 2701876 | FL MGUARD RS4004 TX/DTX | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2701876/firmware_update) |
| 2701877 | FL MGUARD RS4004 TX/DTX VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2701877/firmware_update) |
| 2702259 | FL MGUARD RS4000 TX/TX-P | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2702259/firmware_update) |
| 2702465 | FL MGUARD RS4000 TX/TX VPN-M | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2702465/firmware_update) |
| 2702547 | FL MGUARD CENTERPORT | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2702547/firmware_update) |
| 2702831 | FL MGUARD CORE TX VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2702831/firmware_update) |
| 2702139 | FL MGUARD RS2000 TX/TX-B | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2702139/firmware_update) |
| 1053405 | FL MGUARD SMART2 VPN/K1 | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1053405/firmware_update) |
| 1053403 | FL MGUARD RS4000 TX/TX VPN/K1 | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1053403/firmware_update) |
| 1073940 | FL MGUARD PCIE4000 VPN/K2 | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1073940/firmware_update) |
| 1073943 | FL MGUARD RS4000 VPN/K2 | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1073943/firmware_update) |
| 1073944 | FL MGUARD PCI4000 VPN/K2 | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1073944/firmware_update) |
| 2903441 | TC MGUARD RS2000 3G VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2903441/firmware_update) |
| 2903588 | TC MGUARD RS2000 4G VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2903588/firmware_update) |
| 1010462 | TC MGUARD RS2000 4G VZW VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1010462/firmware_update) |
| 1010464 | TC MGUARD RS2000 4G ATT VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1010464/firmware_update) |
| 2903440 | TC MGUARD RS4000 3G VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2903440/firmware_update) |
| 2903586 | TC MGUARD RS4000 4G VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/2903586/firmware_update) |
| 1010461 | TC MGUARD RS4000 4G VZW VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1010461/firmware_update) |
| 1010463 | TC MGUARD RS4000 4G ATT VPN | <8.8.2 | [Download](http://www.phoenixcontact.net/qr/1010463/firmware_update) |
| 2702528 | TC ROUTER 3002T-4G | <2.05.5 | [Download](http://www.phoenixcontact.net/qr/2702528/firmware_update) |
| 2702530 | TC ROUTER 3002T-4G | <2.05.5 | [Download](http://www.phoenixcontact.net/qr/2702530/firmware_update) |
| 2702529 | TC ROUTER 2002T-3G | <2.05.5 | [Download](http://www.phoenixcontact.net/qr/2702529/firmware_update) |
| 2702531 | TC ROUTER 2002T-3G | <2.05.5 | [Download](http://www.phoenixcontact.net/qr/2702531/firmware_update) |
| 2702532 | TC ROUTER 3002T-4G VZW | <2.05.5 | [Download](http://www.phoenixcontact.net/qr/2702532/firmware_update) |
| 2702533 | TC ROUTER 3002T-4G ATT | <2.05.5 | [Download](http://www.phoenixcontact.net/qr/2702533/firmware_update) |
| 2702886 | TC CLOUD CLIENT 1002-4G | <2.03.19 | [Download](http://www.phoenixcontact.net/qr/2702886/firmware_update) |
| 2702887 | TC CLOUD CLIENT 1002-4G VZW | <2.03.19 | [Download](http://www.phoenixcontact.net/qr/2702887/firmware_update) |
| 2702888 | TC CLOUD CLIENT 1002-4G ATT | <2.03.19 | [Download](http://www.phoenixcontact.net/qr/2702888/firmware_update) |

And all Innominate derivates of FL MGUARD products.

Vulnerabilities 1

Critical 9.8

CVE-2020-8597 Public exploit EPSS 20%

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

ppp lwip lwip ppp Debian Ubuntu Azure Linux Alpine

Feb 3, 2020

Revision history

2020-06-02 #1.0.0
Initial revision.

References

VDE-2020-018: PHOENIX CONTACT: FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT: PPPD vulnerable to CVE-2020-8597 - HTML
https://certvde.com/en/advisories/VDE-2020-018/
Vendor PSIRT
https://phoenixcontact.com/psirt
CERT@VDE Security Advisories for Phoenix Contact GmbH & Co. KG
https://certvde.com/en/advisories/vendor/phoenixcontact/