CVE-2020-12523
Medium
Description
On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource
SeverityMedium
CVSS5.4
Exploit probability—
ProductPhoenixcontact Tc Mguard Rs4000 4g Vzw Vpn Firmware
PublishedDec 17, 2020
First seenDec 17, 2020
Weakness typeCWE-909CWE-909
How to fix
Update
- phoenixcontact tc_mguard_rs4000_4g_vzw_vpn_firmware8.8.3 or later
- phoenixcontact tc_mguard_rs4000_4g_att_vpn_firmware8.8.3 or later
- phoenixcontact fl_mguard_rs4004_tx\/dtx_firmware8.8.3 or later
- phoenixcontact fl_mguard_rs4004_tx\/dtx_vpn_firmware8.8.3 or later
- phoenixcontact tc_mguard_rs4000_4g_vpn_firmware8.8.3 or later
- phoenixcontact innominate_mguard_rs4000_4tx\/tx_firmware8.8.3 or later
- phoenixcontact innominate_mguard_rs4000_4tx\/tx_vpn_firmware8.8.3 or later
- phoenixcontact innominate_mguard_rs4000_4tx\/3g\/tx_vpn_firmware8.8.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixcontact tc_mguard_rs4000_4g_vzw_vpn_firmware | v < 8.8.3 | 8.8.3 |
| phoenixcontact tc_mguard_rs4000_4g_att_vpn_firmware | v < 8.8.3 | 8.8.3 |
| phoenixcontact fl_mguard_rs4004_tx\/dtx_firmware | v < 8.8.3 | 8.8.3 |
| phoenixcontact fl_mguard_rs4004_tx\/dtx_vpn_firmware | v < 8.8.3 | 8.8.3 |
| phoenixcontact tc_mguard_rs4000_3g_vpn_firmware | No range specified | — |
| phoenixcontact tc_mguard_rs4000_4g_vpn_firmware | v < 8.8.3 | 8.8.3 |
| phoenixcontact innominate_mguard_rs4000_4tx\/tx_firmware | v < 8.8.3 | 8.8.3 |
| phoenixcontact innominate_mguard_rs4000_4tx\/tx_vpn_firmware | v < 8.8.3 | 8.8.3 |
| phoenixcontact innominate_mguard_rs4000_4tx\/3g\/tx_vpn_firmware | v < 8.8.3 | 8.8.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.