CVE-2023-37861: PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
First published: Wed Aug 09 2023(Updated: )
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.
Credit: info@cert.vde.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Phoenixcontact Wp 6070-wvps | <4.0.10 | |
| Phoenixcontact WP 6070-WVPS | ||
| Phoenix Contact WP 6101-WXPS | <4.0.10 | |
| Phoenix Contact WP 6101-WXPS | ||
| Phoenix Contact Wp 6121-WXPS | <4.0.10 | |
| Phoenix Contact Wp 6121-WXPS | ||
| Phoenix Contact WP 6156 WHPS | <4.0.10 | |
| Phoenix Contact WP 6156 WHPS | ||
| Phoenix Contact WP 6185 WHPS Firmware | <4.0.10 | |
| Phoenix Contact WP 6185 WHPS | ||
| Phoenix Contact Wp 6215 | <4.0.10 | |
| Phoenix Contact Wp 6215 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this PHOENIX CONTACTs web panels vulnerability?
The vulnerability ID for this PHOENIX CONTACTs web panels vulnerability is CVE-2023-37861.
What is the severity rating of CVE-2023-37861?
CVE-2023-37861 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2023-37861?
Versions prior to 4.0.10 of PHOENIX CONTACTs WP 6xxx series web panels are affected by CVE-2023-37861.
What can an authenticated remote attacker do with CVE-2023-37861?
An authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.
Is there a fix available for CVE-2023-37861?
Yes, upgrading to version 4.0.10 or later of PHOENIX CONTACTs WP 6xxx series web panels will fix CVE-2023-37861.
- agent/type
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/phoenixcontact
- canonical/phoenixcontact wp 6070-wvps
- canonical/phoenix contact wp 6101-wxps
- canonical/phoenix contact wp 6121-wxps
- canonical/phoenix contact wp 6156 whps
- canonical/phoenix contact wp 6185 whps firmware
- canonical/phoenix contact wp 6185 whps
- canonical/phoenix contact wp 6215