by Kastro
Paper/Archive/CVE-2020-12523

CVE-2020-12523

Phoenix Contact TC MGUARD RS4000 4G VZW VPN (1010461) — Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 59.6.596 × 2011.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource

Affected

ProductAffectedFixed inSource
TC MGUARD RS4000 4G VZW VPN (1010461)unspecified – < 8.8.38.8.3CNA
TC MGUARD RS4000 4G ATT VPN (1010463)unspecified – < 8.8.38.8.3CNA
FL MGUARD RS4004 TX/DTX (2701876)unspecified – < 8.8.38.8.3CNA
FL MGUARD RS4004 TX/DTX VPN (2701877)unspecified – < 8.8.38.8.3CNA
TC MGUARD RS4000 3G VPN (2903440)unspecified – < 8.8.38.8.3CNA
TC MGUARD RS4000 4G VPN (2903586)unspecified – < 8.8.38.8.3CNA
Innominate mGuard rs4000 4TX/TXunspecified – < 8.8.38.8.3CNA
Innominate mGuard rs4000 4TX/TX VPNunspecified – < 8.8.38.8.3CNA
Innominate mGuard rs4000 4TX/3G/TX VPNunspecified – < 8.8.38.8.3CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CERTVDE (CNA)5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

References

refcert.vde.com/en-us/advisories/vde-2020-046