CVE-2020-12523
Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.8.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource
Timeline
- CVE published
- Record last updated
Affected versions
- Phoenix Contact TC MGUARD RS4000 4G VZW VPN (1010461)
fixed in 8.8.3
- Phoenix Contact TC MGUARD RS4000 4G ATT VPN (1010463)
fixed in 8.8.3
- Phoenix Contact FL MGUARD RS4004 TX/DTX (2701876)
fixed in 8.8.3
- Phoenix Contact FL MGUARD RS4004 TX/DTX VPN (2701877)
fixed in 8.8.3
- Phoenix Contact TC MGUARD RS4000 3G VPN (2903440)
fixed in 8.8.3
- Phoenix Contact TC MGUARD RS4000 4G VPN (2903586)
fixed in 8.8.3
- Innominate Innominate mGuard rs4000 4TX/TX
fixed in 8.8.3
- Innominate Innominate mGuard rs4000 4TX/TX VPN
fixed in 8.8.3
- Innominate Innominate mGuard rs4000 4TX/3G/TX VPN
fixed in 8.8.3