Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2018-5441

Quick assessment

Affected
n/a PHOENIX CONTACT mGuard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PHOENIX CONTACT mGuard是德国菲尼克斯电气（PHOENIX CONTACT）集团的一套应用于工业以太网领域的设备安全管理软件。 使用7.2至8.6.0版本固件的PHOENIX CONTACT mGuard中存在安全漏洞，该漏洞源于程序没有正确的对更新包执行内部完整性检测。攻击者可利用该漏洞更改固件更新包。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.29% · P21
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2018-5441

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing an attacker to modify firmware update packages.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
完整性检查值验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
PHOENIX CONTACT mGuard 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHOENIX CONTACT mGuard是德国菲尼克斯电气（PHOENIX CONTACT）集团的一套应用于工业以太网领域的设备安全管理软件。 使用7.2至8.6.0版本固件的PHOENIX CONTACT mGuard中存在安全漏洞，该漏洞源于程序没有正确的对更新包执行内部完整性检测。攻击者可利用该漏洞更改固件更新包。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- PHOENIX CONTACT mGuard PHOENIX CONTACT mGuard -

II. Public POCs for CVE-2018-5441

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2018-5441

请登录查看更多情报信息。

Vendor Advisories for CVE-2018-5441 (1)

Other References for CVE-2018-5441 (2)

Same Patch Batch · n/a · 2018-01-30 · 22 CVEs total

CVE-2018-6380 Joomla! 跨站脚本漏洞
CVE-2018-6408 Conceptronic CIPCAMPTIWL 跨站请求伪造漏洞
CVE-2018-6407 Conceptronic CIPCAMPTIWL 安全漏洞
CVE-2018-6406 libwebm 安全漏洞
CVE-2018-6405 ImageMagick 安全漏洞
CVE-2018-6195 WordPress Splashing Images插件代码注入漏洞
CVE-2018-6194 WordPress Splashing Images插件跨站脚本漏洞
CVE-2016-6599 BMC Track-It! 安全漏洞
CVE-2016-6598 BMC Track-It! 安全漏洞
CVE-2011-2902 Debian unstable和Debian squeeze Xpdf 安全漏洞
CVE-2017-1000141 Mahara 18.10.0前版本账户管理漏洞
CVE-2018-6382 MantisBT 安全漏洞
CVE-2018-6379 Joomla! 跨站脚本漏洞
CVE-2018-6377 Joomla! 跨站脚本漏洞
CVE-2018-6376 Joomla! SQL注入漏洞
CVE-2018-6355 iBall 300M 跨站脚本漏洞
CVE-2014-4705 多款Huawei产品eSap software platform 缓冲区错误漏洞
CVE-2017-17969 7-Zip和p7zip 缓冲区错误漏洞
CVE-2018-6398 Joomla! CP Event Calendar SQL注入漏洞
CVE-2018-6397 Joomla! Picture Calendar 路径遍历漏洞

Showing top 20 of 22 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: n/a
Same weakness: CWE-354

V. Comments for CVE-2018-5441

No comments yet

Leave a comment