CVE-2020-125235.4MediumCWE-909

CVE-2020-12523: Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration

Phoenix Contact · TC MGUARD RS4000 4G VZW VPN (1010461)

Fixed in 8.8.3 · Affected: Phoenix Contact TC MGUARD RS4000 4G VZW VPN (1010461) before 8.8.3 · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.9%probability of exploitation in the next 30 days

60th percentile

050100

Higher than 60% of scored CVEs

5.4MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource

Affected products9

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Phoenix Contact · TC MGUARD RS4000 4G VZW VPN (1010461)before 8.8.3
Phoenix Contact · TC MGUARD RS4000 4G ATT VPN (1010463)before 8.8.3
Phoenix Contact · FL MGUARD RS4004 TX/DTX (2701876)before 8.8.3
Phoenix Contact · FL MGUARD RS4004 TX/DTX VPN (2701877)before 8.8.3
Phoenix Contact · TC MGUARD RS4000 3G VPN (2903440)before 8.8.3
Phoenix Contact · TC MGUARD RS4000 4G VPN (2903586)before 8.8.3
Innominate · Innominate mGuard rs4000 4TX/TXbefore 8.8.3
Innominate · Innominate mGuard rs4000 4TX/TX VPNbefore 8.8.3
Innominate · Innominate mGuard rs4000 4TX/3G/TX VPNbefore 8.8.3

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Missing Initialization of Resource · Memory Corruption
Vendor: Phoenix Contact
Published: December 2020
Band: Unlikely (under 1%), December 2020

CoverageNo articles yet

No CyberSIXT article names CVE-2020-12523 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.