CVE-2024-43387: mGuard Privilege Escalation Vulnerability

CVE-2024-43387 Overview

CVE-2024-43387 is a command injection vulnerability affecting Phoenix Contact mGuard industrial security appliances. The flaw resides in the handling of the EMAIL_RELAY_PASSWORD configuration variable, where special elements are not properly neutralized before being passed to a shell context [CWE-78]. A low-privileged, remote authenticated attacker can leverage the flaw to read and write files as root on the underlying device.

Because mGuard devices act as industrial firewalls, VPN concentrators, and secure routers in operational technology (OT) environments, root-level file access effectively surrenders control of a network security boundary to the attacker.

Critical Impact
An authenticated attacker with low privileges can achieve root-level read and write access on mGuard firewall and VPN appliances deployed at the OT/IT boundary.

Affected Products

Phoenix Contact FL MGUARD series (2102, 2105, 4302, 4305, CENTERPORT VPN-1000, CORE TX, DELTA TX/TX, GT/GT, PCI4000, PCIE4000, RS2000, RS2005, RS4000, RS4004, SMART2)
Phoenix Contact TC MGUARD RS2000 3G/4G VPN variants (including ATT and VZW cellular models)
Phoenix Contact TC MGUARD RS4000 3G/4G VPN variants (including ATT and VZW cellular models)

Discovery Timeline

2024-09-10 - CVE-2024-43387 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43387

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. The mGuard firmware exposes configuration variables through its administrative interface, including EMAIL_RELAY_PASSWORD, which is used when the device relays notification email through an SMTP server. The value of this variable is later consumed by a system component that constructs and executes a shell command without sanitizing shell metacharacters.

An attacker with valid low-privileged credentials to the management interface can inject shell metacharacters into EMAIL_RELAY_PASSWORD. When the device processes the value, injected commands execute in the context of the root user. The resulting capability allows reading arbitrary files, writing arbitrary files, and effectively taking full control of the appliance.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The EMAIL_RELAY_PASSWORD value is passed to a downstream shell invocation without escaping, quoting, or validation. Shell metacharacters such as backticks, $(), ;, &&, and | are interpreted rather than treated as literal password data.

Attack Vector

Exploitation requires network access to the mGuard management interface and valid low-privileged credentials. The attacker sets the EMAIL_RELAY_PASSWORD configuration value to a payload containing shell metacharacters wrapped around commands intended to run as root. When the mGuard subsystem that consumes the variable triggers, the injected commands execute with root privileges, granting read and write access to the entire filesystem. See the VDE Security Advisory VDE-2024-039 for vendor technical details.

Detection Methods for CVE-2024-43387

Indicators of Compromise

Unexpected modifications to EMAIL_RELAY_PASSWORD in mGuard configuration exports or profiles.
Presence of shell metacharacters (backticks, $(), ;, |, &&) inside stored SMTP relay password fields.
Unexpected outbound connections initiated by mGuard devices to attacker-controlled hosts.
New or modified files in system directories on the appliance, including /etc, /var, or persistence locations.

Detection Strategies

Audit mGuard configuration backups for anomalous values in EMAIL_RELAY_PASSWORD and other SMTP-related fields.
Monitor administrative interface authentication logs for low-privileged accounts modifying email relay settings.
Alert on configuration changes to mGuard devices from unusual source IP addresses or outside change windows.

Monitoring Recommendations

Forward mGuard syslog and configuration-change events to a central SIEM for correlation with identity and network telemetry.
Baseline expected outbound traffic from mGuard devices and alert on deviations, since the appliance itself is not typically an origin for arbitrary outbound sessions.
Restrict and monitor access to the management interface using network segmentation and jump-host logging.

How to Mitigate CVE-2024-43387

Immediate Actions Required

Apply the firmware update referenced in the VDE Security Advisory VDE-2024-039 to all affected mGuard devices.
Rotate all administrative and low-privileged credentials on mGuard appliances following patching.
Restrict management interface access to a dedicated administrative network or jump host.
Review mGuard configuration for unauthorized changes to EMAIL_RELAY_PASSWORD and other command-relevant fields.

Patch Information

Phoenix Contact and VDE CERT have issued fixed firmware versions for affected mGuard products. Refer to VDE Security Advisory VDE-2024-039 for the specific fixed versions applicable to each device model and firmware branch.

Workarounds

Disable the email notification/SMTP relay feature if it is not required in the deployment.
Limit administrative account provisioning to trusted operators and remove unused low-privileged accounts.
Enforce network access control lists so that only designated management stations can reach the mGuard configuration interface.
Monitor and log all configuration changes to detect abuse of the vulnerable variable prior to patching.

bash

# Configuration example: restrict management access at the network layer
# Example iptables rule on an upstream device to allow only a jump host
iptables -A FORWARD -p tcp -s 10.10.0.5 -d <mguard_ip> --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d <mguard_ip> --dport 443 -j DROP