CVE-2023-37859
HIGHPHOENIX CONTACT WP 6xxx Series Firmware < 4.0.10 - Authenticated Remote Code Execution via SNMP Daemon
Title source: llmDescription
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string to execute system commands as root.
References (1)
Core 1
Core References
Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2023-018/
Scores
CVSS v3
7.2
EPSS
0.0065
EPSS Percentile
46.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-269
Status
published
Products (6)
phoenixcontact/wp_6070-wvps_firmware
< 4.0.10
phoenixcontact/wp_6101-wxps_firmware
< 4.0.10
phoenixcontact/wp_6121-wxps_firmware
< 4.0.10
phoenixcontact/wp_6156-whps_firmware
< 4.0.10
phoenixcontact/wp_6185-whps_firmware
< 4.0.10
phoenixcontact/wp_6215-whps_firmware
< 4.0.10
Published
Aug 09, 2023
Tracked Since
Feb 18, 2026