QwikSec

Security Database

CVE

CWE

Training

CVE-2023-3573

Published: Aug 8, 2023

Modified: Oct 15, 2024

PUBLISHED

CVSS v3.1

8.8

HIGH

Description

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device.

Vendor	Product	Versions
PHOENIX CONTACT	WP 6070-WVPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6101-WXPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6121-WXPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6156-WHPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6185-WHPS	affected `0 - < 4.0.10`
PHOENIX CONTACT	WP 6215-WHPS	affected `0 - < 4.0.10`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://cert.vde.com/en/advisories/VDE-2023-018/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.