CVE-2023-37859: PHOENIX CONTACT: Improper Privilege Management in WP 6xxx Web panels
First published: Wed Aug 09 2023(Updated: )
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string to execute system commands as root.
Credit: info@cert.vde.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Phoenixcontact Wp 6070-wvps | <4.0.10 | |
| Phoenixcontact WP 6070-WVPS | ||
| Phoenix Contact WP 6101-WXPS | <4.0.10 | |
| Phoenix Contact WP 6101-WXPS | ||
| Phoenix Contact Wp 6121-WXPS | <4.0.10 | |
| Phoenix Contact Wp 6121-WXPS | ||
| Phoenix Contact WP 6156 WHPS | <4.0.10 | |
| Phoenix Contact WP 6156 WHPS | ||
| Phoenix Contact WP 6185 WHPS Firmware | <4.0.10 | |
| Phoenix Contact WP 6185 WHPS | ||
| Phoenix Contact Wp 6215 | <4.0.10 | |
| Phoenix Contact Wp 6215 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID is CVE-2023-37859.
What is the severity rating of the vulnerability?
The severity rating of the vulnerability is 7.2 (high).
Which versions of PHOENIX CONTACTs WP 6xxx series web panels are affected?
Versions prior to 4.0.10 of PHOENIX CONTACTs WP 6xxx series web panels are affected.
How does the vulnerability allow an attacker to execute system commands?
The vulnerability allows a remote attacker with knowledge of the SNMPv2 r/w community string to execute system commands as root.
How can I fix this vulnerability?
Upgrade to version 4.0.10 or later of PHOENIX CONTACTs WP 6xxx series web panels to fix this vulnerability.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/phoenixcontact
- canonical/phoenixcontact wp 6070-wvps
- canonical/phoenix contact wp 6101-wxps
- canonical/phoenix contact wp 6121-wxps
- canonical/phoenix contact wp 6156 whps
- canonical/phoenix contact wp 6185 whps firmware
- canonical/phoenix contact wp 6185 whps
- canonical/phoenix contact wp 6215