CVE-2020-12523

published 2020-12-17

CVE-2020-12523: On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard…

critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I N A H

On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource

Affected

17 ranges

Vendor	Product	Version range	Fixed in
innominate	innominate_mguard_rs4000_4tx_3g_tx_vpn	>= unspecified < 8.8.3	8.8.3
innominate	innominate_mguard_rs4000_4tx_tx	>= unspecified < 8.8.3	8.8.3
innominate	innominate_mguard_rs4000_4tx_tx_vpn	>= unspecified < 8.8.3	8.8.3
phoenix_contact	fl_mguard_rs4004_tx_dtx	>= unspecified < 8.8.3	8.8.3
phoenix_contact	fl_mguard_rs4004_tx_dtx_vpn	>= unspecified < 8.8.3	8.8.3
phoenix_contact	tc_mguard_rs4000_3g_vpn	>= unspecified < 8.8.3	8.8.3
phoenix_contact	tc_mguard_rs4000_4g_att_vpn	>= unspecified < 8.8.3	8.8.3
phoenix_contact	tc_mguard_rs4000_4g_vpn	>= unspecified < 8.8.3	8.8.3
phoenix_contact	tc_mguard_rs4000_4g_vzw_vpn	>= unspecified < 8.8.3	8.8.3
phoenixcontact	fl_mguard_rs4004_tx_dtx_firmware	< 8.8.3	8.8.3
phoenixcontact	fl_mguard_rs4004_tx_dtx_vpn_firmware	< 8.8.3	8.8.3
phoenixcontact	innominate_mguard_rs4000_4tx_3g_tx_vpn_firmware	< 8.8.3	8.8.3
phoenixcontact	innominate_mguard_rs4000_4tx_tx_firmware	< 8.8.3	8.8.3
phoenixcontact	innominate_mguard_rs4000_4tx_tx_vpn_firmware	< 8.8.3	8.8.3
phoenixcontact	tc_mguard_rs4000_4g_att_vpn_firmware	< 8.8.3	8.8.3
phoenixcontact	tc_mguard_rs4000_4g_vpn_firmware	< 8.8.3	8.8.3
phoenixcontact	tc_mguard_rs4000_4g_vzw_vpn_firmware	< 8.8.3	8.8.3

CWE-909