PHOENIX CONTACT: mGuard <8.8.3 products missing initialization of resource

After a reboot, disabled switch ports on mGuard devices automatically re-enable regardless of configuration settings, potentially allowing unauthorized network access to previously isolated segments. An attacker could exploit this to bypass network segmentation controls that protect critical OT systems.

Water and electric utilities, manufacturing plants, and other facilities using Phoenix Contact mGuard network switches for OT security. Specifically affects FL MGUARD RS4004 TX/DTX and TC/mGuard RS4000 series devices with integrated switches and VPN capabilities used to segregate legacy control systems from corporate networks.

An attacker with physical access to an mGuard device (or knowledge that one is deployed on a network segment they can access) can wait for or trigger a reboot. Once the device restarts, disabled switch ports automatically become active, allowing traffic that should be blocked. The attacker can then send traffic across the now-active port to reach OT devices on the supposedly isolated network segment.