CVE-2023-37856

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser .
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CERTVDECNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 22%
VendorProductVersion
phoenixcontactwp_6070-wvps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6101-wxps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6121-wxps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6156-whps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6185-whps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6215-whps_firmware
𝑥
< 4.0.10
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cert.vde.com/en/advisories/VDE-2023-018/
https://cert.vde.com/en/advisories/VDE-2023-018/