CVE-2024-43386 Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: PHOENIX CONTACT
product: FL MGUARD 2102
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 2105
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 4102 PCI
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 4102 PCIE
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 4302
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD 4305
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD CENTERPORT VPN-1000
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD CORE TX
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD CORE TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD DELTA TX/TX
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD DELTA TX/TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD GT/GT
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD GT/GT VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD PCI4000
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD PCI4000 VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD PCIE4000
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD PCIE4000 VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS2000 TX/TX-B
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS2000 TX/TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS2005 TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4000 TX/TX
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4000 TX/TX-M
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4000 TX/TX-P
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4000 TX/TX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4004 TX/DTX
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD RS4004 TX/DTX VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD SMART2
default_status: unaffected
vendor: PHOENIX CONTACT
product: FL MGUARD SMART2 VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS2000 3G VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS2000 4G ATT VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS2000 4G VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS2000 4G VZW VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS4000 3G VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS4000 4G ATT VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS4000 4G VPN
default_status: unaffected
vendor: PHOENIX CONTACT
product: TC MGUARD RS4000 4G VZW VPN
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Andrea Palanca
lang: en
value: Nozomi Networks Security Research Team
Published: 2024-09-10T08:43:41.392Z