PHOENIX CONTACT: FL MGUARD affected by two vulnerabilities

Impact
CVE-2022-4304: The OpenSSL library contains a bug that leads to a timing oracle when RSA based ciphers are used without forward secrecy for network communication. By sending a very large number of trial messages, an attacker can try to achieve a decryption of encrypted network packets. This affects TLS connections to and from the FL MGUARD as well as VPN connections. The highest risk arises from deferred attempts to decrypt pre-recorded network sessions. The throttling feature of the FL MGUARD can impede but not prevent the attack.There is a risk that attackers could decrypt network traffic encrypted by the FL MGUARD device.
CVE-2023-2673: If a FL MGUARD or TC MGUARD device is operated in static or autodetect stealth mode, UDP packets which are directed to the protected device do not pass the configured MAC filter rules. The issue does not compromise the incoming IPv4 packet filter, which blocks all incoming traffic by default. The issue does not affect multi stealth mode.There is a risk that attackers could send UDP packets to the protected device which should have been filtered out.

Mitigation
Do not use RSA based ciphers for encryption of network traffic, use cipher suites with forward secrecy for TLS or IPsec communication and renew vulnerable certificates frequently.
Configure the incoming IPv4 packet filter carefully to protect clients from potentially malicious UDP packets.

Remediation
The vulnerabilities are fixed in firmware versions 8.9.1 and 10.2.0.
We strongly recommend all affected FL MGUARD users to upgrade to this or a later version.