Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products

published 2024-09-10 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-48581

cvss: 5.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits: 0; none known

A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks.

Patch / fix

fixed in 30

PHOENIX CONTACT FL MGUARD 2102 10.4.1
PHOENIX CONTACT FL MGUARD 2105 10.4.1
PHOENIX CONTACT FL MGUARD 4102 PCI 10.4.1
PHOENIX CONTACT FL MGUARD 4102 PCIE 10.4.1
PHOENIX CONTACT FL MGUARD 4302 10.4.1
PHOENIX CONTACT FL MGUARD 4305 10.4.1
PHOENIX CONTACT FL MGUARD CENTERPORT VPN-1000 8.9.3
PHOENIX CONTACT FL MGUARD CORE TX 8.9.3
PHOENIX CONTACT FL MGUARD CORE TX VPN 8.9.3
PHOENIX CONTACT FL MGUARD DELTA TX/TX 8.9.3
PHOENIX CONTACT FL MGUARD DELTA TX/TX VPN 8.9.3
PHOENIX CONTACT FL MGUARD GT/GT 8.9.3
PHOENIX CONTACT FL MGUARD GT/GT VPN 8.9.3
PHOENIX CONTACT FL MGUARD PCI4000 8.9.3
PHOENIX CONTACT FL MGUARD PCI4000 VPN 8.9.3
PHOENIX CONTACT FL MGUARD PCIE4000 8.9.3
PHOENIX CONTACT FL MGUARD PCIE4000 VPN 8.9.3
PHOENIX CONTACT FL MGUARD RS2000 TX/TX-B 8.9.3
PHOENIX CONTACT FL MGUARD RS2000 TX/TX VPN 8.9.3
PHOENIX CONTACT FL MGUARD RS2005 TX VPN 8.9.3
PHOENIX CONTACT FL MGUARD RS4000 TX/TX 8.9.3
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-M 8.9.3
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-P 8.9.3
PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN 8.9.3
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX 8.9.3
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX VPN 8.9.3
PHOENIX CONTACT FL MGUARD SMART2 8.9.3
PHOENIX CONTACT FL MGUARD SMART2 VPN 8.9.3
PHOENIX CONTACT TC MGUARD RS2000 3G VPN 8.9.3
PHOENIX CONTACT TC MGUARD RS2000 4G ATT VPN 8.9.3

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-09-10)

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected products

PHOENIX CONTACT FL MGUARD 2102
PHOENIX CONTACT FL MGUARD 2105
PHOENIX CONTACT FL MGUARD 4102 PCI
PHOENIX CONTACT FL MGUARD 4102 PCIE
PHOENIX CONTACT FL MGUARD 4302
PHOENIX CONTACT FL MGUARD 4305
PHOENIX CONTACT FL MGUARD CENTERPORT VPN-1000
PHOENIX CONTACT FL MGUARD CORE TX
PHOENIX CONTACT FL MGUARD CORE TX VPN
PHOENIX CONTACT FL MGUARD DELTA TX/TX
PHOENIX CONTACT FL MGUARD DELTA TX/TX VPN
PHOENIX CONTACT FL MGUARD GT/GT
PHOENIX CONTACT FL MGUARD GT/GT VPN
PHOENIX CONTACT FL MGUARD PCI4000
PHOENIX CONTACT FL MGUARD PCI4000 VPN
PHOENIX CONTACT FL MGUARD PCIE4000
PHOENIX CONTACT FL MGUARD PCIE4000 VPN
PHOENIX CONTACT FL MGUARD RS2000 TX/TX-B
PHOENIX CONTACT FL MGUARD RS2000 TX/TX VPN
PHOENIX CONTACT FL MGUARD RS2005 TX VPN
PHOENIX CONTACT FL MGUARD RS4000 TX/TX
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-M
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-P
PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX VPN
PHOENIX CONTACT FL MGUARD SMART2
PHOENIX CONTACT FL MGUARD SMART2 VPN
PHOENIX CONTACT TC MGUARD RS2000 3G VPN
PHOENIX CONTACT TC MGUARD RS2000 4G ATT VPN
PHOENIX CONTACT TC MGUARD RS2000 4G VPN
PHOENIX CONTACT TC MGUARD RS2000 4G VZW VPN
PHOENIX CONTACT TC MGUARD RS4000 3G VPN
PHOENIX CONTACT TC MGUARD RS4000 4G ATT VPN
PHOENIX CONTACT TC MGUARD RS4000 4G VPN
PHOENIX CONTACT TC MGUARD RS4000 4G VZW VPN

Classification

Weakness

CWE-201 Insertion of Sensitive Information Into Sent Data

References

cert.vde.com /en/advisories/VDE-2024-039
third-party-advisory

Sources

CVE List CVE-2024-7698
NVD CVE-2024-7698

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary