Phoenix Contact: Two vulnerabilities in the jq JSON processor utilized by FL MGUARD 110x devices

An attacker with valid credentials to a FL MGUARD 110x device could exploit vulnerabilities in the jq JSON processor during firmware configuration migration to cause a denial of service or potentially corrupt device configuration, disrupting network security appliance operations.

Organizations using Phoenix Contact FL MGUARD 1102 or 1105 industrial firewall/security appliances should prioritize this update. These devices are commonly used to protect industrial networks and provide security filtering at network boundaries in manufacturing, water/wastewater, electrical, and other critical infrastructure environments.

An attacker with valid administrative or engineering credentials on the device would trigger the jq JSON processor during a firmware configuration migration. The attacker could craft a malicious JSON payload that exploits the integer overflow (CWE-190) or buffer overflow (CWE-787) to crash the processor or execute code on the device, which runs security and filtering functions for the network.