CVE-2024-43385: Phoenix Contact: OS command execution through PROXY_HTTP_PORT in mGuard devices

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-10 · updated 2026-06-17
Weakness: CWE-78

Description

A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices.

Affected products

Phoenixcontact Fl Mguard 2102 Firmware: before 10.4.1 — fixed in 10.4.1
Phoenixcontact Fl Mguard 2105 Firmware: before 10.4.1 — fixed in 10.4.1
Phoenixcontact Fl Mguard 4102 Pci Firmware: before 10.4.1 — fixed in 10.4.1
Phoenixcontact Fl Mguard 4102 Pcie Firmware: before 10.4.1 — fixed in 10.4.1
Phoenixcontact Fl Mguard 4302 Firmware: before 10.4.1 — fixed in 10.4.1
Phoenixcontact Fl Mguard 4305 Firmware: before 10.4.1 — fixed in 10.4.1
Phoenixcontact Fl Mguard Centerport Vpn-1000 Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Core Tx Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Core Tx Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Delta Tx/Tx Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Delta Tx/Tx Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Gt/Gt Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Gt/Gt Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Pci4000 Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Pci4000 Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Pcie4000 Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Pcie4000 Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs2000 Tx/Tx-B Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs2000 Tx/Tx Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs2005 Tx Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs4000 Tx/Tx-M Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs4000 Tx/Tx-P Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs4000 Tx/Tx Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs4000 Tx/Tx Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs4004 Tx/Dtx Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Rs4004 Tx/Dtx Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Smart2 Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Fl Mguard Smart2 Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Tc Mguard Rs2000 3G Vpn Firmware: before 8.9.3 — fixed in 8.9.3
Phoenixcontact Tc Mguard Rs2000 4G Att Vpn Firmware: before 8.9.3 — fixed in 8.9.3

How to fix

Upgrade to a fixed version: Phoenixcontact Fl Mguard 2102 Firmware 10.4.1; Phoenixcontact Fl Mguard 2105 Firmware 10.4.1; Phoenixcontact Fl Mguard 4102 Pci Firmware 10.4.1; Phoenixcontact Fl Mguard 4102 Pcie Firmware 10.4.1; Phoenixcontact Fl Mguard 4302 Firmware 10.4.1; Phoenixcontact Fl Mguard 4305 Firmware 10.4.1; Phoenixcontact Fl Mguard Centerport Vpn-1000 Firmware 8.9.3; Phoenixcontact Fl Mguard Core Tx Firmware 8.9.3; Phoenixcontact Fl Mguard Core Tx Vpn Firmware 8.9.3; Phoenixcontact Fl Mguard Delta Tx/Tx Firmware 8.9.3; Phoenixcontact Fl Mguard Delta Tx/Tx Vpn Firmware 8.9.3; Phoenixcontact Fl Mguard Gt/Gt Firmware 8.9.3. Check the vendor advisory for mitigations.

References

https://cert.vde.com/en/advisories/VDE-2024-039

Get alerted when CVE-2024-43385 or the next vulnerability affects your stack