PT-2023-4519 · Phoenix Contact · Phoenix Contact Wp 6Xxx

Gabriele Quagliarella · Published 2023-08-08 · Updated 2023-08-15 · CVE-2023-37863

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT WP 6xxx versions prior to 4.0.10

Description The issue exists due to the lack of measures to neutralize special elements in the software of PHOENIX CONTACT WP 6xxx web panels, which are used for management and monitoring in industrial systems. A remote attacker with SNMPv2 write privileges may use a special SNMP request to gain full access to the device, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 4.0.10, update to version 4.0.10 or later to resolve the issue. As a temporary workaround, consider restricting SNMPv2 write privileges to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-04922

CVE-2023-37863

Affected Products

Phoenix Contact Wp 6Xxx

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-37863 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37863 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04922 · Security Note
• https://t.me/cvenotify/56047 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2023-018 · Note