CVE-2023-37860

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CERTVDECNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
VendorProductVersion
phoenixcontactwp_6070-wvps
𝑥
< 4.0.10
phoenixcontactwp_6101-wxps
𝑥
< 4.0.10
phoenixcontactwp_6121-wxps
𝑥
< 4.0.10
phoenixcontactwp_6156-whps
𝑥
< 4.0.10
phoenixcontactwp_6185-whps
𝑥
< 4.0.10
phoenixcontactwp_6215-whps
𝑥
< 4.0.10
phoenixcontactwp_6070-wvps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6101-wxps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6121-wxps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6156-whps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6185-whps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6215-whps_firmware
𝑥
< 4.0.10
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cert.vde.com/en/advisories/VDE-2023-018/
https://cert.vde.com/en/advisories/VDE-2023-018/