CVE-2023-3572
CRITICALPHOENIX CONTACT WP 6xxx < 4.0.10 - Unauthenticated HTTP POST Command Injection
Title source: manualDescription
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.
References (1)
Core 1
Core References
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2023-018/
Scores
CVSS v3
10.0
EPSS
0.0079
EPSS Percentile
51.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (6)
phoenixcontact/wp_6070-wvps_firmware
< 4.0.10
phoenixcontact/wp_6101-wxps_firmware
< 4.0.10
phoenixcontact/wp_6121-wxps_firmware
< 4.0.10
phoenixcontact/wp_6156-whps_firmware
< 4.0.10
phoenixcontact/wp_6185-whps_firmware
< 4.0.10
phoenixcontact/wp_6215-whps_firmware
< 4.0.10
Published
Aug 08, 2023
Tracked Since
Feb 18, 2026