QwikSec

Security Database

CVE

CWE

Training

CVE-2023-3572

Published: Aug 8, 2023

Modified: Oct 15, 2024

PUBLISHED

CVSS v3.1

10.0

CRITICAL

Description

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.

Vendor	Product	Versions
PHOENIX CONTACT	WP 6070-WVPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6101-WXPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6121-WXPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6156-WHPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6185-WHPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6215-WHPS	affected `0 - < 4.0.10`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

https://cert.vde.com/en/advisories/VDE-2023-018/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.