3.8
Low
CVE-2023-37857 In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin…
Description
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP 6070-WVPS 4.0 | earliest → < 4.0.10 | 4.0.10 |
| WP 6101-WXPS 4.0 | earliest → < 4.0.10 | 4.0.10 |
| WP 6121-WXPS 4.0 | earliest → < 4.0.10 | 4.0.10 |
| WP 6156-WHPS 4.0 | earliest → < 4.0.10 | 4.0.10 |
| WP 6185-WHPS 4.0 | earliest → < 4.0.10 | 4.0.10 |
| WP 6215-WHPS 4.0 | earliest → < 4.0.10 | 4.0.10 |
Other CVEs of WP 6070-WVPS
The 14 CVEs of WP 6070-WVPS →
CVE-2023-37858
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin…
4.9
Medium
CVE-2023-37855
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is…
4.3
Medium
CVE-2023-37856
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is…
4.3
Medium
CVE-2023-37863
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges…
7.2
High