PT-2023-4196 · Phoenix Contact · Wp 6Xxx Series Web Panels

Gabriele Quagliarella · Published 2023-08-08 · Updated 2023-08-25 · CVE-2023-3573

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACTs WP 6xxx series web panels versions prior to 4.0.10

Description A remote attacker with low privileges may use a command injection in a HTTP POST request related to font configuration operations to gain full access to the device. The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow an attacker to gain unauthorized access to the device using a specially crafted POST request.

Recommendations For versions prior to 4.0.10, update to version 4.0.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the font configuration operations to minimize the risk of exploitation. Avoid using the vulnerable HTTP POST request related to font configuration operations until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-04511

CVE-2023-3573

Affected Products

Wp 6Xxx Series Web Panels

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3573 · Security Note
• https://bdu.fstec.ru/vul/2023-04511 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3573 · Vendor Advisory
• https://t.me/cvenotify/57269 · Telegram Post
• https://twitter.com/cracbot/status/1689154628938874880 · Twitter Post
• https://t.me/cvenotify/55972 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2023-018 · Note