Share: Email | Twitter

ID

VDE-2019-020

Published

2019-10-29 11:56 (CET)

Last update

2019-10-29 11:56 (CET)

Vendor(s)

PHOENIX CONTACT GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
2702882 FL NAT 2208 < 2.90
2702981 FL NAT 2304-2GC-2SFP < 2.90

Summary

If MAC-based port security or 802.1x port security is enabled, the FL NAT 2xxx will unintentionally grant access to unauthorized devices in case of routed transmission.

Subnet 2---(Ports belonging to subnet 2)
|
FL NAT 2xxx
|
(Ports belonging to subnet 1, port sec ON)---- 2nd device
|
-- unauthorized device

The unauthorized device can access other devices in subnet 2 but cannot access the 2nd device in subnet 1


Last Update:

Feb. 19, 2020, 8:53 a.m.

Weakness

Improper Access Control  (CWE-284) 

Summary

If MAC-based port security or 802.1x port security is enabled, the FL NAT 2xxx will unintentionally grant access to unauthorized devices in case of routed transmission.

Impact

If port security is enabled on a port, a device not authorized by MAC based port security or 802.1x based port security can access another subnet via the FL NAT 2xxx device that is routing between the subnet the unauthorized device is residing in and the 2nd subnet.

Solution

Temporary Fix / Mitigation

This vulnerability will be fixed with the next firmware release V2.90, which will be available Q02/2020.

In the meantime, user should take care that network security is not relying solely on separating subnets with MAC or 802.1x based port security if the FL NAT 2xxx device is serving as a router between the subnets.

NOTE

If traps/logs/syslog for unauthorized access are enabled, notifications about the unauthorized access will be sent.

Reported by

PHOENIX CONTACT reported this vulnerability to CERT@VDE