Security Advisory
Vulnerability in routers FL MGUARD and TC MGUARD
1 Advisory Information
Advisory ID: BOSCH-SA-982696
CVE Numbers and CVSS v3.1 Scores: CVE-2022-0778
o Base Score: 7.5 (High)
Published: 27 Apr 2022
Last Updated: 27 Apr 2022

2 Summary
The FL MGUARD and TC MGUARD safety devices sold by Bosch Rexroth are devices from Phoenix Contactthat have been introduced as trade goods. A security advisory has been published by the manufacturer, whichindicates that devices are affected by a possible infinite loop within an OpenSSL library method [1].

3 Affected Products
Parts No.

Parts Shorttext

PxC No.

ArticleR901351745
R901352542
R901541498
R911173814
R911173815
R911173816
R911173817
R911173818
R913050362
R913051602
R913056204
R913058931
R913066122
R913073676
R913073677
R913076699

FL MGUARD RS4000 TX/&
FL MGUARD RS4000 VPN&
TC MGUARD RS4000 4G &FL MGUARD RS4000 TX/&
TC MGUARD RS2000 3G &TC MGUARD RS4000 3G &FL MGUARD DELTA TX/T&
FL MGUARD SMART2 VPN&
FL MGUARD RS4004 TX/&
FL MGUARD RS4004 TX/&FL MGUARD RS2000 TX/&
FL MGUARD RS2000 TX/&
TC MGUARD RS2000 4G &FL MGUARD RS4000 TX/&
FL MGUARD SMART2 VPN&
FL MGUARD RS4000 TX/&

2700634
22005152903586
220051529034412903440
2700967
27006392701876
2701877
2702139270064229035881053403
1053405
2700634

FL MGUARD RS4000 TX/TX
FL MGUARD RS4000 TX/TX VPN
TC MGUARD RS4000 4G VPN
FL MGUARD RS4000 TX/TX VPN
TC MGUARD RS2000 3G VPN
TC MGUARD RS4000 3G VPN
FL MGUARD DELTA TX/TX
FL MGUARD SMART2 VPN
FL MGUARD RS4004 TX/DTX
FL MGUARD RS4004 TX/DTX VPN
FL MGUARD RS2000 TX/TX-B
FL MGUARD RS2000 TX/TX VPN
TC MGUARD RS2000 4G VPN
FL MGUARD RS4000 TX/TX VPN/K1
FL MGUARD SMART2 VPN/K1
FL MGUARD RS4000 TX/TX

Affected versions <= 8.8.5. Fixed version is available in the Security Advisory of the supplier [1].

Copyright © 2022 Bosch Rexroth AG

Security Advisory BOSCH-SA-982696

4 Solution
4.1

Update to the latest released versions

It is strongly recommended to update the firmware version of the affected devices. Please find further details onthe security advisory of the supplier [1].

5 Vulnerability Details
5.1

CVE-2022-0778

CVE description: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that cancause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that containelliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded incompressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curveparameters. Since certificate parsing happens prior to verification of the certificate signature, any process thatparses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop canalso be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus
vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming clientcertificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing
certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any
other applications that use the BN_mod_sqrt() where the attacker can control the parameter values arevulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of
the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires thepublic key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed
certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions
1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed inOpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL
1.0.2zd (Affected 1.0.2-1.0.2zc).
 Problem Type:o CWE-835
 CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
o Base Score: 7.5 (High)

6 Additional Resources[1] Security Advisory for FL MGUARD, TC MGUARD, mGuard Device Manager and FL WLAN devices:
https://dam-mdc.phoenixcontact.com/asset/156443151564/d98ef17b0dd8e44798e61a15105a834b/Security_Advisory_CVE-2022-0778.pdf[2] Security Guideline Electric Drives and Controls:
https://www.boschrexroth.com/de/de/myrexroth/media-directory-download?object_nr=R911342562

7 Revision History
27 Apr 2022: Initial Publication

Copyright © 2022 Bosch Rexroth AG

Page 2 of 2