CVE-2017-5159 Misconfiguration in Phoenix Contact mGuard 8.4.0
Updating Phoenix Contact mGuard devices resets the admin password to default, allowing unauthorized administrative access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-5159?
CVE-2017-5159 is a critical vulnerability in Phoenix Contact mGuard 8.4.0, published on 13 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value.
Weakness: CWE-99
Which versions are affected by CVE-2017-5159?
It affects 1 product.
Products include Phoenixcontact Mguard Firmware.
How do I fix CVE-2017-5159?
No fix has been published for CVE-2017-5159 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-5159 being exploited?
There is no known exploitation of CVE-2017-5159 in the wild and no public exploit code.
Sources
Also known as GHSA-xh78-5j99-gwm4.