Phoenix Contact: Firewall reconfiguration through the FW_PORTFORWARDING.SRC_IP in MGUARD devices

The vulnerability lies in the FWPORTFORWARDING.SRCIP environment variable, which allows an attacker to modify critical firewall services. Successful exploitation could lead to the disruption of network traffic, blocking legitimate users and services. An attacker could configure packet filters to drop all traffic, disable packet forwarding, or manipulate network access control rules, effectively rendering the firewall useless. The blast radius extends to any systems relying on the firewall for protection, potentially impacting entire networks.

Organizations relying on FL MGUARD 2102 firewalls for network security are at risk, particularly those with exposed management interfaces or those using default configurations. Environments with limited network segmentation or monitoring are also more vulnerable.

1. 2024-09-10Disclosure

   disclosure

1. 予約済み2024-08-12
2. 公開日2024-09-10
3. 更新日2025-08-22
4. EPSS 更新日2026-04-02

The primary mitigation is to upgrade FL MGUARD 2102 firewalls to version 10.4.1 or later. If an immediate upgrade is not possible, consider restricting access to the configuration interface and carefully auditing the FWPORTFORWARDING.SRCIP environment variable for any unauthorized changes. Implement strict input validation on any user-supplied data used in firewall configuration to prevent malicious manipulation. Review firewall rules and logs for any suspicious activity.