Skip to content
OpenAdvisories
Medium VDE-2025-109 1 CVE

Phoenix Contact: Unbounded growth of the session cache in TCP encapsulation service in FL MGUARD 2xxx and 4xxx firmware

Published Feb 10, 2026 · Updated Feb 23, 2026 · Revision 2

Vendor: OpenSSL Software Foundation Vendor: Phoenix Contact Product: FL MGUARD 2102 Product: FL MGUARD 2105 Product: FL MGUARD 4102 PCI Product: FL MGUARD 4102 PCIE Product: FL MGUARD 4302 Product: FL MGUARD 4305 Product: OpenSSL

Summary

The OpenSSL library used in the affected products is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.

Details

Impact
A remote attacker can exhaust all the memory by establishing a large number of TLSv1.3 connections to the TCP encapsulation service, causing the device to reboot.

Mitigation
It is recommended to disable TCP encapsulation on affected mGuard devices and use Pathfinder instead.

Remediation
Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 10.6.0 or higher which fixes this vulnerability.

Product Description
mGuards are industrial routers and security appliances

Vulnerabilities 1

  • Medium 5.9
    CVE-2024-2511 EPSS 59%

    Unbounded memory growth with session handling in TLSv1.3

    Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #1.0.1

    Updated category type in product tree.

  2. #1.0.0

    Initial release.

References