CVE-2020-12523 — Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration

On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource

Published Dec 17, 2020Updated Sep 16, 2024Sources: cvelistV5, CERTVDE

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

chance of exploitation in 30 days

Affects

phoenix contact

9 products listed

CVSS base

5.4

MEDIUM

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (2)

phoenix contact innominate

Products (9)

tc mguard rs4000 4g vzw vpn 1010461tc mguard rs4000 4g att vpn 1010463fl mguard rs4004 tx dtx 2701876fl mguard rs4004 tx dtx vpn 2701877tc mguard rs4000 3g vpn 2903440tc mguard rs4000 4g vpn 2903586innominate mguard rs4000 4tx txinnominate mguard rs4000 4tx tx vpninnominate mguard rs4000 4tx 3g tx vpn

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Source
5.4	CVSS 3.1	MEDIUM	—	—	cvelistV5

Weakness & attack patterns

CWE-909

References

1 on the record

cert.vde.com/en-us/advisories/vde-2020-046
x_refsource_CONFIRM

Elsewhere on this site

phoenix contactevery CVE for this vendor
innominateevery CVE for this vendor
CWE-909other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.