Summary
Confidential data in HTTP query string of user requests.
Incomplete sanitation of user input in administrative web interface.
Details
Impact
Attackers can gain knowledge of confidential user data.
Attackers can escalate their privileges on the system.
Attackers can trigger covert misbehavior within several services.
Mitigation
Access to the administrative interfaces should be granted only to trustworthy users.
Remediation
Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 8.9.3 / 10.4.1 or higher which fixes these vulnerabilities.
Product Description
mGuards are industrial routers and security appliances
Vulnerabilities 12
-
High 8.8
Phoenix Contact: OS command execution through PROXY_HTTP_PORT in mGuard devices
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices.
-
High 8.8
Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices.
-
High 8.8
Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices
A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices.
-
High 8.8
Phoenix Contact: SNMP reconfiguration due to improper input validation in MGUARD devices
A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation.
-
High 8.8
Phoenix Contact: OS command execution in MGUARD products
An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data.
-
High 8.1
Phoenix Contact: OSPF reconfiguration due to improper input validation in MGUARD devices
A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS.
-
High 8.1
Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devices
A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS.
-
High 8.1
Phoenix Contact: Firewall reconfiguration through the FW_PORTFORWARDING.SRC_IP in MGUARD devices
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_PORTFORWARDING.SRC_IP environment variable which can lead to a DoS.
-
High 8.1
Phoenix Contact: Firewall reconfiguration through the FW_environment variables in MGUARD devices
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP envi…
-
High 8.1
Phoenix Contact: Configuration changes of the firewall services can lead to DoS in MGUARD devices
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP FW_R…
-
High 8.0
Phoenix Contact: Improper removal of sensitive information in MGUARD products
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.
-
Medium 5.7
Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products
A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks.
Revision history
-
#1.1.2
Update: CWE from CVE-2024-43388, CVE-2024-43389, CVE-2024-43390, CVE-2024-43391, CVE-2024-43392, CVE-2024-43393, CVE-2024-7698, Revision History
-
#1.0.2
Fixed csaf reference URL
-
#1.0.1
Fix: correct certvde domain, added self-reference
-
#1.0.0
Initial revision.
References
-
Phoenix Contact PSIRT
https://phoenixcontact.com/psirt
-
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact/
-
VDE-2024-039: Phoenix Contact: Multiple Vulnerabilities in mGuard devices - HTML
https://certvde.com/en/advisories/VDE-2024-039