PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
CVE-2023-37863

7.2HIGH

Key Information:

Vendor
WordPress
Status
WP 6070-wvps
WP 6101-wxps
WP 6121-wxps
WP 6156-wHPs
Vendor
CVE Published:
9 August 2023

Summary

A vulnerability exists in PHOENIX CONTACT WP 6xxx series web panels prior to version 4.0.10, where a remote attacker with SNMPv2 write privileges can exploit it through specially crafted SNMP requests. This poses a significant risk as it allows unauthorized users to gain full access to the affected devices, potentially compromising device integrity and security.

Affected Version(s)

WP 6070-WVPS 0 < 4.0.10

WP 6101-WXPS 0 < 4.0.10

WP 6121-WXPS 0 < 4.0.10

References

https://cert.vde.com/en/advisories/VDE-2023-018/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriele Quagliarella from Nozomi Networks Labs
.