CVE-2020-12523

Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration

State: Published
Severity: 5.4 Medium
Published: Dec 17, 2020
Updated: Sep 16, 2024
Reserved: Apr 30, 2020

Read the record on cve.org

Description

On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L	CERTVDE

Weaknesses

CWE-909 Missing Initialization of Resource

Affected Products

Product	Versions
TC MGUARD RS4000 4G VZW VPN (1010461)Phoenix Contact	before 8.8.3Affected
TC MGUARD RS4000 4G ATT VPN (1010463)Phoenix Contact	before 8.8.3Affected
FL MGUARD RS4004 TX/DTX (2701876)Phoenix Contact	before 8.8.3Affected
FL MGUARD RS4004 TX/DTX VPN (2701877)Phoenix Contact	before 8.8.3Affected
TC MGUARD RS4000 3G VPN (2903440)Phoenix Contact	before 8.8.3Affected
TC MGUARD RS4000 4G VPN (2903586)Phoenix Contact	before 8.8.3Affected
Innominate mGuard rs4000 4TX/TXInnominate	before 8.8.3Affected
Innominate mGuard rs4000 4TX/TX VPNInnominate	before 8.8.3Affected
Innominate mGuard rs4000 4TX/3G/TX VPNInnominate	before 8.8.3Affected

References

https://cert.vde.com/en-us/advisories/vde-2020-046

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.