Lucene search
HistoryAug 09, 2023 - 7:15 a.m.
CVE-2023-37861
vulnerability
phoenix contacts
web panels
remote code execution
root permissions
http post
certificate upload
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
8.7
Confidence
High
EPSS
0.002
Percentile
58.7%
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.
Affected configurations
Node
phoenixcontactwp_6070-wvps_firmwareRange<4.0.10
phoenixcontactwp_6070-wvpsMatch-
Node
phoenixcontactwp_6101-wxps_firmwareRange<4.0.10
phoenixcontactwp_6101-wxpsMatch-
Node
phoenixcontactwp_6121-wxps_firmwareRange<4.0.10
phoenixcontactwp_6121-wxpsMatch-
Node
phoenixcontactwp_6156-whps_firmwareRange<4.0.10
phoenixcontactwp_6156-whpsMatch-
Node
phoenixcontactwp_6185-whps_firmwareRange<4.0.10
phoenixcontactwp_6185-whpsMatch-
Node
phoenixcontactwp_6215-whps_firmwareRange<4.0.10
phoenixcontactwp_6215-whpsMatch-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| phoenixcontact | wp_6070-wvps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6070-wvps | - | cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6101-wxps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6101-wxps | - | cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6121-wxps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6121-wxps | - | cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6156-whps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6156-whps | - | cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:* |
| phoenixcontact | wp_6185-whps_firmware | * | cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:* |
| phoenixcontact | wp_6185-whps | - | cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:* |
References
Related
cve
cve
CVE-2023-37861
2023-08-09 07:15:11
prion
prion
Code injection
2023-08-09 07:15:00
cvelist
cvelist
CVE-2023-37861 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
2023-08-09 06:34:36
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
8.7
Confidence
High
EPSS
0.002
Percentile
58.7%
Related for NVD:CVE-2023-37861