PT-2023-4198 · Phoenix Contact · Wp 6Xxx Series Web Panels

Gabriele Quagliarella · Published 2023-08-08 · Updated 2023-09-08 · CVE-2023-3572

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACTs WP 6xxx series web panels versions prior to 4.0.10

Description A remote, unauthenticated attacker may use an attribute of a specific HTTP POST request related to date/time operations to gain full access to the device. The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to the device using a specially crafted POST request.

Recommendations For versions prior to 4.0.10, update to version 4.0.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the device and limiting the use of HTTP POST requests related to date/time operations until a patch is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-04513

CVE-2023-3572

Affected Products

Wp 6Xxx Series Web Panels

References · 6

• https://osv.dev/vulnerability/CVE-2023-3572 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-3572 · Security Note
• https://twitter.com/cracbot/status/1689154627290398721 · Twitter Post
• https://t.me/cvenotify/55973 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2023-018 · Note