Security Advisory

Vulnerability in routers FL MGUARD andTC MGUARD
1 Advisory Information
Advisory ID: BOSCH-SA-931197
CVE Numbers and CVSS v3.1 Scores: CVE-2022-3480
o Base Score: 7.5 (High)

Published: 03 Mar 2023

Last Updated: 03 Mar 2023

2 Summary
Possible denial of service on HTTPS management interface
The FL MGUARD and TC MGUARD devices sold by Bosch Rexroth are devices from Phoenix Contact that havebeen introduced as trade goods. A security advisory has been published by the manufacturer, which indicatesthat a denial of service of the HTTPS management interface of that devices can be triggered by a larger numberof unauthenticated HTTPS connections, incoming from different source IP’s [1]. Configuring firewall limits forincoming connections cannot prevent the issue.
During the attack, the HTTPS management interface is no more accessible for valid users. Additionally, there
may be an impact on the performance of other services of the FL MGUARD or TC MGUARD device. An
unexpected reboot of the device is possible.

3 Affected Products
Parts No.

Parts Shorttext

PxC No.

ArticleR901351745
R901352542
R901541498
R911173814
R911173815
R911173816
R911173817
R911173818
R913050362
R913051602
R913056204
R913058931
R913066122
R913076699

FL MGUARD RS4000 TX/&
FL MGUARD RS4000 VPN&
TC MGUARD RS4000 4G &FL MGUARD RS4000 TX/&
TC MGUARD RS2000 3G &TC MGUARD RS4000 3G &FL MGUARD DELTA TX/T&
FL MGUARD SMART2 VPN&
FL MGUARD RS4004 TX/&
FL MGUARD RS4004 TX/&
FL MGUARD RS2000 TX/&
FL MGUARD RS2000 TX/&
TC MGUARD RS2000 4G &FL MGUARD RS4000 TX/&2700634
22005152903586
220051529034412903440
2700967
27006392701876
2701877
2702139270064229035882700634

FL MGUARD RS4000 TX/TX
FL MGUARD RS4000 TX/TX VPN
TC MGUARD RS4000 4G VPN
FL MGUARD RS4000 TX/TX VPN
TC MGUARD RS2000 3G VPN
TC MGUARD RS4000 3G VPN
FL MGUARD DELTA TX/TX
FL MGUARD SMART2 VPN
FL MGUARD RS4004 TX/DTX
FL MGUARD RS4004 TX/DTX VPN
FL MGUARD RS2000 TX/TX-B
FL MGUARD RS2000 TX/TX VPN
TC MGUARD RS2000 4G VPN
FL MGUARD RS4000 TX/TX

Affected versions <= 8.9.0. Fixed version is available in the Security Advisory of the supplier [1].

Copyright © 2023 Bosch Rexroth AG

Security Advisory BOSCH-SA-931197

4 Solution
4.1

Update to the latest released version

The vulnerability is fixed in firmware version 8.9.0. We strongly recommend all affected users to upgrade to thisor a later version.

4.2

Temporary Fix / Mitigation

Don’t allow access to the HTTPS management interface from untrusted networks.

5 Vulnerability Details
5.1

CVE-2022-3480

CVE description: A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL
MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger number of unauthenticated HTTPS
connections originating from different source IP’s. Configuring firewall limits for incoming connections cannot
prevent the issue.
 Problem Type:o CWE-770 Allocation of Resources Without Limits or Throttling CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
o Base Score: 7.5 (High)

6 Additional Resources[1] Security Advisory for FL MGUARD, TC MGUARD:

https://dam-mdc.phoenixcontact.com/asset/156443151564/632a4cc10e4af34cb7b75da31a2f03a1/Security_Advisory_CVE-2022-3480.pdf[2] Bosch Rexroth Security Guideline Electric Drives and Controls:

https://www.boschrexroth.com/various/utilities/mediadirectory/download/index.jsp?object_nr=R911342562

7 Revision History
03 Mar 2023: Initial Publication

Copyright © 2023 Bosch Rexroth AGPage 2 of 2