CVE-2023-37862

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial denial-of-service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CERTVDECNA
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
VendorProductVersion
phoenixcontactwp_6070-wvps
𝑥
< 4.0.10
phoenixcontactwp_6101-wxps
𝑥
< 4.0.10
phoenixcontactwp_6121-wxps
𝑥
< 4.0.10
phoenixcontactwp_6156-whps
𝑥
< 4.0.10
phoenixcontactwp_6185-whps
𝑥
< 4.0.10
phoenixcontactwp_6215-whps
𝑥
< 4.0.10
phoenixcontactwp_6070-wvps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6101-wxps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6121-wxps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6156-whps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6185-whps_firmware
𝑥
< 4.0.10
phoenixcontactwp_6215-whps_firmware
𝑥
< 4.0.10
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cert.vde.com/en/advisories/VDE-2023-018/
https://cert.vde.com/en/advisories/VDE-2023-018/