Summary
The jq JSON processor, which is used to migrate firmware configurations in the product, contains 2 vulnerabilities that can be exploited by an authenticated attacker.
Impact
An authenticated attacker can cause a denial of service.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 1153079 | FL MGUARD 1102 | Firmware <1.8.1 |
| 1153078 | FL MGUARD 1105 | Firmware <1.8.1 |
Vulnerabilities
Expand / Collapse allAn authenticated attacker can cause a denial of service (crash of HTTPS request processor) by sending malformed data to the device in an HTTPS request.
In FL MGUARD devices, the jq JSON processor is used to migrate firmware configurations. The vulnerability can only be exploited by an authenticated administrative user in FL MGUARD devices. This reduces the vulnerability's severity to: CVSS-Score: 4.9, CSSS-Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.
An authenticated attacker can cause a denial of service (memory exhaustion) by sending malformed data to the device in an HTTPS request. The impact is mitigated by the device enforcing a limit to the maximum HTTPS request size. To launch a successful attack, an attacker would have to circumvent this limit.
In FL MGUARD devices, the jq JSON processor is used to migrate firmware configurations. The vulnerability can only be exploited by an authenticated administrative user in FL MGUARD devices. This reduces the vulnerability's severity to: CVSS-Score: 4.9, CSSS-Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.
Remediation
Phoenix Contact strongly recommends upgrading affected mGuard devices to firmware version 1.8.1 or higher which fixes this vulnerability.
Acknowledgments
Phoenix Contact GmbH & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 04.08.2025 12:00 | Initial revision. |