CVE-2024-43385: Phoenix Contact mGuard RCE Vulnerability

CVE-2024-43385 Overview

CVE-2024-43385 is an OS command injection vulnerability affecting Phoenix Contact mGuard devices. The flaw stems from improper neutralization of special elements in the PROXY_HTTP_PORT variable. A low-privileged remote attacker can exploit this weakness to execute arbitrary operating system commands with root privileges on the affected device.

The vulnerability is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command. It impacts a broad portfolio of mGuard industrial security appliances used in operational technology (OT) environments for firewall, VPN, and network segmentation duties.

Critical Impact
Authenticated remote attackers with low privileges can achieve full root-level command execution, compromising the confidentiality, integrity, and availability of industrial network security appliances.

Affected Products

Phoenix Contact FL MGUARD series (2102, 2105, 4102 PCI/PCIe, 4302, 4305, CORE TX, DELTA TX/TX, GT/GT, PCI4000, PCIE4000, RS2000/RS2005/RS4000/RS4004, SMART2, CENTERPORT VPN-1000) firmware and hardware variants
Phoenix Contact TC MGUARD series (RS2000 3G/4G/4G ATT/4G VZW VPN, RS4000 3G/4G/4G ATT/4G VZW VPN) firmware and hardware variants
All VPN and non-VPN variants of the mGuard product family listed in the vendor advisory

Discovery Timeline

2024-09-10 - CVE-2024-43385 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43385

Vulnerability Analysis

The vulnerability resides in the handling of the PROXY_HTTP_PORT configuration variable within the mGuard firmware. The device fails to properly sanitize special shell metacharacters passed through this variable before incorporating its value into an OS command invocation. Attackers who can authenticate with low-privileged credentials can inject shell operators such as ;, |, &&, or backticks into PROXY_HTTP_PORT, causing the underlying shell to interpret and execute injected commands.

Since mGuard services process the affected variable in a context running as root, injected commands inherit full superuser rights. This grants attackers the ability to modify firewall rules, tamper with VPN configuration, deploy persistent implants, pivot into segmented industrial networks, or disable the device outright.

Root Cause

The root cause is the absence of strict input validation and neutralization for the PROXY_HTTP_PORT value. The affected firmware routines pass user-controllable content directly into a command interpreter without escaping or restricting characters to numeric port values. A correct implementation would reject any non-numeric input or use safe parameterized execution APIs rather than shell interpolation.

Attack Vector

Exploitation requires network access to the device management interface and a low-privileged account. No user interaction is needed. An attacker submits a crafted PROXY_HTTP_PORT value containing shell metacharacters through the configuration mechanism. When the device processes the value in a privileged context, the injected payload executes as root. Full technical details are documented in the VDE Security Advisory VDE-2024-039.

Detection Methods for CVE-2024-43385

Indicators of Compromise

Unexpected changes to firewall, routing, or VPN configuration on mGuard appliances not tied to authorized administrator sessions
Configuration audit logs showing PROXY_HTTP_PORT values containing non-numeric characters or shell metacharacters (;, |, &, `, $()
Outbound network connections from mGuard management interfaces to unfamiliar hosts, indicating potential reverse shells or data staging
New or modified files, cron entries, or startup scripts on the device filesystem following configuration write events

Detection Strategies

Monitor authenticated management sessions to mGuard devices and correlate configuration changes against approved change tickets
Inspect device syslog output for command execution errors or shell warnings that follow proxy configuration updates
Deploy network monitoring to alert on management-plane traffic sourced from users or subnets that should not be interacting with OT security appliances

Monitoring Recommendations

Forward mGuard syslog and audit events to a centralized SIEM or data lake for retention and correlation with identity and network telemetry
Baseline normal administrative activity on mGuard devices and alert on deviations, particularly configuration writes touching proxy variables
Track authentication events, including low-privileged account logins, and investigate any followed by configuration changes to sensitive variables

How to Mitigate CVE-2024-43385

Immediate Actions Required

Apply the firmware updates published by Phoenix Contact for all affected mGuard models as referenced in VDE-2024-039
Restrict management interface access to a dedicated administration network using strict firewall rules and jump hosts
Review and reduce the number of accounts with any level of access to mGuard configuration, and rotate credentials for existing accounts
Audit recent configuration history on all mGuard devices for suspicious PROXY_HTTP_PORT values or unexplained changes

Patch Information

Phoenix Contact has coordinated remediation through CERT@VDE. Refer to the VDE Security Advisory VDE-2024-039 for the definitive list of fixed firmware versions per model and download locations. Apply patches on a maintenance window with documented rollback procedures for OT environments.

Workarounds

Where patching is not immediately feasible, disable HTTP proxy functionality and avoid setting the PROXY_HTTP_PORT variable
Enforce network segmentation so that only trusted administrator workstations can reach the mGuard management interface
Require multi-factor authentication or bastion access in front of the mGuard management plane to reduce the pool of potential attackers with low-privileged credentials

bash

# Example: restrict mGuard management access at the upstream firewall
# Allow only the admin jump host to reach the management interface
iptables -A FORWARD -s 10.10.50.5/32 -d 10.20.0.1/32 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.0.1/32 -p tcp --dport 443 -j DROP