CVE-2023-37857lowCWE-798

CVE-2023-37857: fallo de gravedad baja en PHOENIX CONTACT WP 6070-WVPS

PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WP 6070-WVPS+ Monitorear WP 6101-WXPS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.8epss 0.6%
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Productos afectados
PHOENIX CONTACT · WP 6070-WVPSPHOENIX CONTACT · WP 6101-WXPSPHOENIX CONTACT · WP 6121-WXPSPHOENIX CONTACT · WP 6156-WHPSPHOENIX CONTACT · WP 6185-WHPSPHOENIX CONTACT · WP 6215-WHPS
CVEs relacionadas — PHOENIX CONTACT WP 6070-WVPS

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-3573HIGHPHOENIX CONTACT: Command Injection in WP 6xxx Web panelsEPSS 1.2%CVE-2023-3572CRITICALPHOENIX CONTACT: OS Command Injection in WP 6xxx Web panelsEPSS 1.0%CVE-2023-3570HIGHPHOENIX CONTACT: OS Command Injection in WP 6xxx Web panelsEPSS 0.9%CVE-2023-37863HIGHPHOENIX CONTACT: OS Command Injection in WP 6xxx Web panelsEPSS 0.9%CVE-2023-37861HIGHPHOENIX CONTACT: OS Command Injection in WP 6xxx Web panelsEPSS 0.9%CVE-2023-37859HIGHPHOENIX CONTACT: Improper Privilege Management in WP 6xxx Web panelsEPSS 0.9%