Lucene search
HistoryAug 08, 2023 - 7:15 a.m.
CVE-2023-3570
phoenix contact
wp 6xxx series
web panels
vulnerability
remote attacker
low privileges
http delete request
full access
device
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
8.8
Confidence
High
EPSS
0.002
Percentile
56.4%
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device.
Affected configurations
Node
phoenixcontactwp_6070-wvps_firmwareRange<4.0.10
phoenixcontactwp_6070-wvpsMatch-
Node
phoenixcontactwp_6101-wxps_firmwareRange<4.0.10
phoenixcontactwp_6101-wxpsMatch-
Node
phoenixcontactwp_6121-wxps_firmwareRange<4.0.10
phoenixcontactwp_6121-wxpsMatch-
Node
phoenixcontactwp_6156-whpsMatch-
phoenixcontactwp_6156-whps_firmwareRange<4.0.10
Node
phoenixcontactwp_6185-whpsMatch-
phoenixcontactwp_6185-whps_firmwareRange<4.0.10
Node
phoenixcontactwp_6215-whpsMatch-
phoenixcontactwp_6215-whps_firmwareRange<4.0.10
| Vendor | Product | Version | CPE |
|---|---|---|---|
| phoenixcontact | wp_6070-wvps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6070-wvps | - | cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6101-wxps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6101-wxps | - | cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6121-wxps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6121-wxps | - | cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6156-whps | - | cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6156-whps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6185-whps | - | cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6185-whps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:* |
References
Related
prion
prion
Cross site request forgery (csrf)
2023-08-08 07:15:00
cve
cve
CVE-2023-3570
2023-08-08 07:15:10
cvelist
cvelist
CVE-2023-3570 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
2023-08-08 06:52:57
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
8.8
Confidence
High
EPSS
0.002
Percentile
56.4%
Related for NVD:CVE-2023-3570