Summary
The pathfinder TCP encapsulation service is vulnerable to a drain of open file descriptors.
Details
Impact
Attackers can trigger a denial-of-service of the pathfinder TCP encapsulation service.
Mitigation
Access to the listen port of the pathfinder TCP encapsulation service should be limited to trustworthy networks or peers.
Remediation
Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 8.9.3 / 10.4.1 or higher which fix this vulnerability.
Product Description
mGuards are industrial routers and security appliances
Vulnerabilities 1
-
Medium 5.3
Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors.
An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encapsulation service. The impact is limited to blocking of valid IPsec VPN peers.
Revision history
-
#4
Fix: added distribution
-
#3
Fixed current csaf reference URL
-
#2
Fix: correct certvde domain, added self-reference
-
#1
Initial revision.
References
-
PCSA-2024/00010: mGuard firmware <8.9.3 / 10.4.1 is vulnerable to a drain of open file descriptors.
https://phoenixcontact.com/psirt
-
Phoenix Contact PSIRT
https://phoenixcontact.com/psirt
-
Phoenix Contact advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/phoenixcontact/
-
VDE-2024-052: Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors. - HTML
https://certvde.com/en/advisories/VDE-2024-052