Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-12523— Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration

CVSS 5.4 · Medium EPSS 0.38% · P59
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2020-12523

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration
Source: NVD (National Vulnerability Database)
Vulnerability Description
On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
资源初始化缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Phoenix Contact mGuard Devices 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Phoenix Contact Mguard是德国Phoenix Contac（Phoenix Contact）公司的一款应用于工业环境的防火墙设备。该设备具备多重防护模式、深度数据包检测技术、恶意软件及病毒检测技术。 Phoenix Contact mGuard Devices versions before 8.8.3 存在安全漏洞，该漏洞源于对于局域网端集成开关的mGuard设备，可以通过设备配置禁用单个开关端口。重新启动后，这些端口的功能与它们的配置设置无关:缺少资源初始化。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Phoenix ContactTC MGUARD RS4000 4G VZW VPN (1010461) unspecified ~ 8.8.3 -
Phoenix ContactTC MGUARD RS4000 4G ATT VPN (1010463) unspecified ~ 8.8.3 -
Phoenix ContactFL MGUARD RS4004 TX/DTX (2701876) unspecified ~ 8.8.3 -
Phoenix ContactFL MGUARD RS4004 TX/DTX VPN (2701877) unspecified ~ 8.8.3 -
Phoenix ContactTC MGUARD RS4000 3G VPN (2903440) unspecified ~ 8.8.3 -
Phoenix ContactTC MGUARD RS4000 4G VPN (2903586) unspecified ~ 8.8.3 -
InnominateInnominate mGuard rs4000 4TX/TX unspecified ~ 8.8.3 -
InnominateInnominate mGuard rs4000 4TX/TX VPN unspecified ~ 8.8.3 -
InnominateInnominate mGuard rs4000 4TX/3G/TX VPN unspecified ~ 8.8.3 -

II. Public POCs for CVE-2020-12523

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-12523

请登录查看更多情报信息。

Same Patch Batch · Phoenix Contact · 2020-12-17 · 5 CVEs total

CVE-2020-125178.8 HIGHPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low p
CVE-2020-125198.8 HIGHPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use th
CVE-2020-125216.5 MEDIUMPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LL
CVE-2020-125185.5 MEDIUMPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use th

IV. Related Vulnerabilities

Same vendor: Phoenix Contact
Same weakness: CWE-909

V. Comments for CVE-2020-12523

No comments yet

Leave a comment