Phoenix Contact: Reconfiguración del firewall a través de FW_PORTFORWARDING.SRC_IP en dispositivos MGUARD

The vulnerability lies in the FWPORTFORWARDING.SRCIP environment variable, which allows an attacker to modify critical firewall services. Successful exploitation could lead to the disruption of network traffic, blocking legitimate users and services. An attacker could configure packet filters to drop all traffic, disable packet forwarding, or manipulate network access control rules, effectively rendering the firewall useless. The blast radius extends to any systems relying on the firewall for protection, potentially impacting entire networks.

Organizations relying on FL MGUARD 2102 firewalls for network security are at risk, particularly those with exposed management interfaces or those using default configurations. Environments with limited network segmentation or monitoring are also more vulnerable.

1. 2024-09-10Disclosure

   disclosure

1. Reservado2024-08-12
2. Publicada2024-09-10
3. Modificada2025-08-22
4. EPSS actualizado2026-04-02

The primary mitigation is to upgrade FL MGUARD 2102 firewalls to version 10.4.1 or later. If an immediate upgrade is not possible, consider restricting access to the configuration interface and carefully auditing the FWPORTFORWARDING.SRCIP environment variable for any unauthorized changes. Implement strict input validation on any user-supplied data used in firewall configuration to prevent malicious manipulation. Review firewall rules and logs for any suspicious activity.