Phoenix Contact: Multiple Vulnerabilities in mGuard devices

An attacker with valid administrative credentials could read sensitive configuration or operational data from the device and potentially execute arbitrary commands on the mGuard appliance, compromising network segmentation and potentially gaining access to connected industrial networks.

Water utilities and power companies using Phoenix Contact mGuard network security appliances are affected. These devices are deployed at the boundary between corporate IT networks and operational technology networks (SCADA, PLC networks, RTU communications). Organizations with critical process automation or remote access capabilities relying on mGuard for network segmentation should prioritize patching.

An attacker with valid administrative credentials accesses the web interface of an mGuard device. The attacker exploits incomplete input validation to inject commands or reads confidential data exposed in HTTP query strings to extract credentials or configuration details that could be used for further lateral movement into the OT network.