CVE-2024-43392 Phoenix Contact: Firewall reconfiguration through the FW_environment variables in MGUARD devices
A low-privileged remote attacker can inject code via environment variables to reconfigure firewall services, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-43392?
CVE-2024-43392 is a high-severity code injection vulnerability in PHOENIX CONTACT FL MGUARD 2102, published on 10 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP environment variable which can lead to a DoS.
Weakness: CWE-94
Which versions are affected by CVE-2024-43392?
It affects 30 products.
Products include Phoenixcontact Fl Mguard Centerport Vpn-1000 Firmware, Phoenixcontact Fl Mguard Core Tx Firmware, Phoenixcontact Fl Mguard Core Tx Vpn Firmware, Phoenixcontact Fl Mguard Delta Tx\/Tx Firmware, Phoenixcontact Fl Mguard Delta Tx\/Tx Vpn Firmware, Phoenixcontact Fl Mguard Gt\/Gt Firmware and 24 more.
How do I fix CVE-2024-43392?
No fix has been published for CVE-2024-43392 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-43392 being exploited?
There is no known exploitation of CVE-2024-43392 in the wild and no public exploit code.
Sources
Also known as GHSA-c4g6-rrx2-j7rm.