CVE-2018-5441: phoenixcontact mguard_centerport_firmware
Vulnerability summary
CVE-2018-5441 is a high (CVSS 7.8) vulnerability in phoenixcontact mguard_centerport_firmware. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.5% of scored vulnerabilities.
Timeline
- 30-01-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing an attacker to modify firmware update packages.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-354Improper Validation of Integrity Check ValueThe product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Phoenixcontact23 products
- mguard_centerport_firmware≥ 7.2.0, ≤ 8.6.0
- mguard_core_tx_vpn_firmware≥ 7.2.0, ≤ 8.6.0
- mguard_delta_tx\/tx_firmware≥ 7.2.0, ≤ 8.6.0
- mguard_delta_tx\/tx_vpn_firmware≥ 7.2.0, ≤ 8.6.0
- mguard_gt\/gt_firmware≥ 7.2.0, ≤ 8.6.0
1 vendor · 23 products
References
3 links- ics-cert.us-cert.gov/advisories/ICSA-18-030-01X Refsource MISCThird Party AdvisoryUS Government Resource