PT-2023-4652 · Phoenix Contact · Wp 6Xxx Series Web Panels

Gabriele Quagliarella · Published 2023-08-08 · Updated 2023-08-15 · CVE-2023-37861

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACTs WP 6xxx series web panels versions prior to 4.0.10

Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This can allow a remote attacker to execute arbitrary code using a specially crafted HTTP POST request, such as when uploading a certificate to the device. An authenticated remote attacker can execute code with root permissions.

Recommendations For versions prior to 4.0.10, update to version 4.0.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the certificate upload feature until a patch is available. Avoid using the vulnerable HTTP POST request to upload certificates to the device until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-05061

CVE-2023-37861

Affected Products

Wp 6Xxx Series Web Panels

References · 6

• https://osv.dev/vulnerability/CVE-2023-37861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37861 · Security Note
• https://bdu.fstec.ru/vul/2023-05061 · Security Note
• https://t.me/cibsecurity/68079 · Telegram Post
• https://t.me/cvenotify/56049 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2023-018 · Note