PHOENIX CONTACT mGuard
Plan PatchCVSS 7.8ICS-CERT ICSA-18-030-01Jan 30, 2018
Phoenix Contact
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Phoenix Contact mGuard firmware versions 7.2 through 8.6.0 contain a vulnerability (CWE-354) that can be exploited with low skill level. The vulnerability allows local exploitation through user interaction.
What this means
What could happen
An attacker with local access to an mGuard device could gain complete control over the device through user interaction, potentially allowing them to bypass security controls, modify network traffic rules, or disrupt network operations protected by the mGuard.
Who's at risk
Organizations using Phoenix Contact mGuard devices (industrial network security appliances and industrial firewalls) in any critical infrastructure sector, including water utilities, electric utilities, and manufacturing facilities, should implement isolation and access controls to minimize risk.
How it could be exploited
An attacker with physical or local network access to an mGuard device could trigger the vulnerability through user interaction (such as clicking a malicious link or opening a crafted file on the device). This would allow the attacker to execute code with the privileges of the user, potentially escalating to full device control.
Prerequisites
- Local or network access to the mGuard device
- User interaction required (opening a file, clicking a link, or similar action on the device)
- Target device running mGuard firmware version 7.2 through 8.6.0
Low complexity exploitationUser interaction requiredNo patch availableLocal access neededAffects network security devices
Exploitability
Unlikely to be exploited — EPSS score 0.0%
Affected products (24)
23 with fix1 EOL
ProductAffected VersionsFix Status
mGuard firmware:≥ 7.2 | ≤ 8.6.0No fix (EOL)
FL MGUARD CENTERPORT7.2≤ 8.6.08.6.1
FL MGUARD CORE TX VPN7.2≤ 8.6.08.6.1
FL MGUARD DELTA TX/TX7.2≤ 8.6.08.6.1
FL MGUARD DELTA TX/TX VPN7.2≤ 8.6.08.6.1
Remediation & Mitigation
0/5
Do now
0/2HARDENINGIsolate mGuard devices from the Internet and place them behind firewalls with strict access controls
HARDENINGRestrict network access to mGuard devices to only authorized users and systems; disable unnecessary network services
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
WORKAROUNDIf remote access to mGuard is required, use a VPN with current patches and strong authentication to limit exposure
Long-term hardening
0/1HOTFIXMonitor for vendor security updates or firmware patches as they become available
Mitigations - no patch available
0/1mGuard firmware: has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGTrain users not to interact with untrusted files or links on mGuard devices or connected systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/a9d7926c-53a1-4824-aab6-b5cfc0d2fb20Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.