Lucene search

[email protected]CVE-2018-5441

HistoryJan 30, 2018 - 8:29 p.m.

CVE-2018-5441

2018-01-3020:29:00

CWE-20

CWE-354

[email protected]

web.nvd.nist.gov

phoenix contact

mguard

firmware

vulnerability

cve-2018-5441

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.3%

JSON

An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing an attacker to modify firmware update packages.

Affected configurations

NVD

Node

phoenixcontactmguard_centerport_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_centerportMatch-

Node

phoenixcontactmguard_delta_tx\/tx_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_delta_tx\/txMatch-

Node

phoenixcontactmguard_delta_tx\/tx_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_delta_tx\/tx_vpnMatch-

Node

phoenixcontactmguard_gt\/gt_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_gt\/gtMatch-

Node

phoenixcontactmguard_gt\/gt_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_gt\/gt_vpnMatch-

Node

phoenixcontactmguard_pci4000_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_pci4000_vpnMatch-

Node

phoenixcontactmguard_pcie4000_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_pcie4000_vpnMatch-

Node

phoenixcontactmguard_rs2000_tx\/tx_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs2000_tx\/tx_vpnMatch-

Node

phoenixcontactmguard_rs2000_tx\/tx-b_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs2000_tx\/tx-bMatch-

Node

phoenixcontactmguard_rs2005_tx_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs2005_tx_vpnMatch-

Node

phoenixcontactmguard_rs4000_tx\/tx_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs4000_tx\/txMatch-

Node

phoenixcontactmguard_rs4000_tx\/tx_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs4000_tx\/tx_vpnMatch-

Node

phoenixcontactmguard_rs4000_tx\/tx_vpn-m_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs4000_tx\/tx_vpn-mMatch-

Node

phoenixcontactmguard_rs4000_tx\/tx-p_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs4000_tx\/tx-pMatch-

Node

phoenixcontactmguard_rs4004_tx\/dtx_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs4004_tx\/dtxMatch-

Node

phoenixcontactmguard_rs4004_tx\/dtx_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs4004_tx\/dtx_vpnMatch-

Node

phoenixcontactmguard_smart2_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_smart2Match-

Node

phoenixcontactmguard_smart2_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_smart2_vpnMatch-

Node

phoenixcontactmguard_rs2000_3g_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs2000_3g_vpnMatch-

Node

phoenixcontactmguard_rs4000_3g_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs4000_3g_vpnMatch-

Node

phoenixcontactmguard_core_tx_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_core_tx_vpnMatch-

Node

phoenixcontactmguard_rs2000_4g_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs2000_4g_vpnMatch-

Node

phoenixcontactmguard_rs4000_4g_vpn_firmwareRange7.2.0–8.6.0

AND

phoenixcontactmguard_rs4000_4g_vpnMatch-

CPENameOperatorVersion
phoenixcontact:mguard_centerport_firmwarephoenixcontact mguard centerport firmwarele8.6.0

CPE	Name	Operator	Version
phoenixcontact:mguard_centerport_firmware	phoenixcontact mguard centerport firmware	le	8.6.0

CNA Affected

[
  {
    "product": "PHOENIX CONTACT mGuard",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "PHOENIX CONTACT mGuard"
      }
    ]
  }
]

References

www.securityfocus.com/bid/102907

cert.vde.com/en-us/advisories/vde-2018-001

ics-cert.us-cert.gov/advisories/ICSA-18-030-01

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.3%

JSON

Related for CVE-2018-5441

cvelist1 ics1 nvd1 prion1