Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-43386— Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.

Quick assessment

Affected
PHOENIX CONTACT FL MGUARD 2102
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PHOENIX CONTACT FL/TC MGUARD是德国菲尼克斯电气（PHOENIX）公司的一系列路由器。 PHOENIX CONTACT FL/TC MGUARD存在安全漏洞，该漏洞源于 mGuard 设备中变量 EMAIL_NOTIFICATION.TO 中特殊元素的不正确中和，低特权远程攻击者可以触发以 root 身份执行任意操作系统命令。

CVSS 8.8 · High EPSS 0.74% · P52

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-43386

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.
Source: CVE Program / CVE List V5
Vulnerability Description
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
PHOENIX CONTACT FL/TC MGUARD 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHOENIX CONTACT FL/TC MGUARD是德国菲尼克斯电气（PHOENIX）公司的一系列路由器。 PHOENIX CONTACT FL/TC MGUARD存在安全漏洞，该漏洞源于 mGuard 设备中变量 EMAIL_NOTIFICATION.TO 中特殊元素的不正确中和，低特权远程攻击者可以触发以 root 身份执行任意操作系统命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
PHOENIX CONTACT FL MGUARD 2102 0 ~ 10.4.1 -
PHOENIX CONTACT FL MGUARD 2105 0 ~ 10.4.1 -
PHOENIX CONTACT FL MGUARD 4102 PCI 0 ~ 10.4.1 -
PHOENIX CONTACT FL MGUARD 4102 PCIE 0 ~ 10.4.1 -
PHOENIX CONTACT FL MGUARD 4302 0 ~ 10.4.1 -
PHOENIX CONTACT FL MGUARD 4305 0 ~ 10.4.1 -
PHOENIX CONTACT FL MGUARD CENTERPORT VPN-1000 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD CORE TX 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD CORE TX VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD DELTA TX/TX 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD DELTA TX/TX VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD GT/GT 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD GT/GT VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD PCI4000 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD PCI4000 VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD PCIE4000 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD PCIE4000 VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS2000 TX/TX-B 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS2000 TX/TX VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS2005 TX VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS4000 TX/TX 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-M 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-P 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX VPN 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD SMART2 0 ~ 8.9.3 -
PHOENIX CONTACT FL MGUARD SMART2 VPN 0 ~ 8.9.3 -
PHOENIX CONTACT TC MGUARD RS2000 3G VPN 0 ~ 8.9.3 -
PHOENIX CONTACT TC MGUARD RS2000 4G ATT VPN 0 ~ 8.9.3 -

II. Public POCs for CVE-2024-43386

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-43386

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-43386 (1)

Same Patch Batch · PHOENIX CONTACT · 2024-09-10 · 12 CVEs total

CVE-2024-7699 8.8 HIGH Phoenix Contact: OS command execution in MGUARD products
CVE-2024-43387 8.8 HIGH Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD
CVE-2024-43388 8.8 HIGH Phoenix Contact: SNMP reconfiguration due to improper input validation in MGUARD devices
CVE-2024-43385 8.8 HIGH Phoenix Contact: OS command execution through PROXY_HTTP_PORT in mGuard devices
CVE-2024-43391 8.1 HIGH Phoenix Contact: Firewall reconfiguration through the FW_PORTFORWARDING.SRC_IP in MGUARD d
CVE-2024-43389 8.1 HIGH Phoenix Contact: OSPF reconfiguration due to improper input validation in MGUARD devices
CVE-2024-43393 8.1 HIGH Phoenix Contact: Configuration changes of the firewall services can lead to DoS in MGUARD
CVE-2024-43390 8.1 HIGH Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devic
CVE-2024-43392 8.1 HIGH Phoenix Contact: Firewall reconfiguration through the FW_environment variables in MGUARD
CVE-2024-7698 5.7 MEDIUM Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products
CVE-2024-7734 5.3 MEDIUM Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptor

IV. Related Vulnerabilities

Same product: FL MGUARD 2102
Same vendor: PHOENIX CONTACT
Same weakness: CWE-78

V. Comments for CVE-2024-43386

No comments yet

Leave a comment