Vulnerability Details CVE-2023-37861
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.011
EPSS Ranking 76.7%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2023-37861
-
cpe:2.3:h:phoenixcontact:wp_6070-wvps:-
-
cpe:2.3:h:phoenixcontact:wp_6101-wxps:-
-
cpe:2.3:h:phoenixcontact:wp_6121-wxps:-
-
cpe:2.3:h:phoenixcontact:wp_6156-whps:-
-
cpe:2.3:h:phoenixcontact:wp_6185-whps:-
-
cpe:2.3:h:phoenixcontact:wp_6215-whps:-
-
cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*
-
cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*
-
cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*
-
cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*
-
cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*
-
cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*