CVE-2024-7699

Phoenix Contact: OS command execution in MGUARD products

High8.8EPSS 0.76%

Published: 10 Sept 2024
Updated: 10 Sept 2024
Reserved: 12 Aug 2024
Assigned by: CERTVDE

Description

An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data.

Scores

CVSS scores of CVE-2024-7699, by who scored it
Scored by	CVSS	Score	Vector
CERTVDECNA (assigner)	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.76% · top 44% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

PHOENIX CONTACT · FL MGUARD 2102
- affected < 10.4.1
PHOENIX CONTACT · FL MGUARD 2105
- affected < 10.4.1
PHOENIX CONTACT · FL MGUARD 4102 PCI
- affected < 10.4.1
PHOENIX CONTACT · FL MGUARD 4102 PCIE
- affected < 10.4.1
PHOENIX CONTACT · FL MGUARD 4302
- affected < 10.4.1
PHOENIX CONTACT · FL MGUARD 4305
- affected < 10.4.1
PHOENIX CONTACT · FL MGUARD CENTERPORT VPN-1000
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD CORE TX
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD CORE TX VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD DELTA TX/TX
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD DELTA TX/TX VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD GT/GT
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD GT/GT VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD PCI4000
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD PCI4000 VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD PCIE4000
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD PCIE4000 VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS2000 TX/TX-B
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS2000 TX/TX VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS2005 TX VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS4000 TX/TX
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS4000 TX/TX-M
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS4000 TX/TX-P
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS4000 TX/TX VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS4004 TX/DTX
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD RS4004 TX/DTX VPN
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD SMART2
- affected < 8.9.3
PHOENIX CONTACT · FL MGUARD SMART2 VPN
- affected < 8.9.3
PHOENIX CONTACT · TC MGUARD RS2000 3G VPN
- affected < 8.9.3
PHOENIX CONTACT · TC MGUARD RS2000 4G ATT VPN
- affected < 8.9.3
PHOENIX CONTACT · TC MGUARD RS2000 4G VPN
- affected < 8.9.3
PHOENIX CONTACT · TC MGUARD RS2000 4G VZW VPN
- affected < 8.9.3
PHOENIX CONTACT · TC MGUARD RS4000 3G VPN
- affected < 8.9.3
PHOENIX CONTACT · TC MGUARD RS4000 4G ATT VPN
- affected < 8.9.3
PHOENIX CONTACT · TC MGUARD RS4000 4G VPN
- affected < 8.9.3
PHOENIX CONTACT · TC MGUARD RS4000 4G VZW VPN
- affected < 8.9.3

References (1)

https://cert.vde.com/en/advisories/VDE-2024-039 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-7699](https://trackcve.app/badge/CVE-2024-7699.svg)](https://trackcve.app/cve/CVE-2024-7699)

Record last updated 10 Sept 2024, 14:25 UTC.