PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
CVE-2023-3572

10CRITICAL

Key Information:

Vendor
WordPress
Status
WP 6070-wvps
WP 6101-wxps
WP 6121-wxps
WP 6156-wHPs
Vendor
CVE Published:
8 August 2023

Summary

A vulnerability in PHOENIX CONTACT's WP 6xxx series web panels allows remote, unauthenticated attackers to exploit a specific attribute in an HTTP POST request related to date/time operations. This can lead to complete unauthorized access to the affected devices, posing significant risks to their integrity and the networks they are part of.

Affected Version(s)

WP 6070-WVPS 0 < 4.0.10

WP 6101-WXPS 0 < 4.0.10

WP 6121-WXPS 0 < 4.0.10

References

https://cert.vde.com/en/advisories/VDE-2023-018/

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriele Quagliarella from Nozomi Networks Labs
.