PT-2023-4524 · Phoenix Contact · Phoenix Contact Wp 6Xxx Series Web Panels

Gabriele Quagliarella · Published 2023-08-08 · Updated 2023-08-15 · CVE-2023-37864

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT WP 6xxx series web panels versions prior to 4.0.10

Description The issue is related to a software vulnerability in the web panels for management and monitoring of processes in industrial systems. It is associated with shortcomings in the authorization procedure. An attacker with SNMPv2 write privileges may use a special SNMP request to gain full access to the device. This could allow a remote attacker to obtain unauthorized access to the device.

Recommendations For versions prior to 4.0.10, update to version 4.0.10 or later to resolve the issue. As a temporary workaround, consider restricting SNMPv2 write privileges to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-494

Related Identifiers

BDU:2023-04927

CVE-2023-37864

Affected Products

Phoenix Contact Wp 6Xxx Series Web Panels

References · 6

• https://osv.dev/vulnerability/CVE-2023-37864 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04927 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-37864 · Security Note
• https://vuldb.com/ru/?id.236629 · Note
• https://twitter.com/VulmonFeeds/status/1689229614579621888 · Twitter Post
• https://cert.vde.com/en/advisories/VDE-2023-018 · Note