CVE-2023-3573

EUVD-2023-44224
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CERTVDECNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
Affected Products (NVD)
VendorProductVersion
phoenixcontactwp_6070-wvps
𝑥
< 4.0.10
phoenixcontactwp_6101-wxps
𝑥
< 4.0.10
phoenixcontactwp_6121-wxps
𝑥
< 4.0.10
phoenixcontactwp_6156-whps
𝑥
< 4.0.10
phoenixcontactwp_6185-whps
𝑥
< 4.0.10
phoenixcontactwp_6215-whps
𝑥
< 4.0.10
phoenixcontactwp_6070-wvps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6101-wxps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6121-wxps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6156-whps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6185-whps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6215-whps_firmware
𝑥
< 4.0.10
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cert.vde.com/en/advisories/VDE-2023-018/
https://cert.vde.com/en/advisories/VDE-2023-018/