CVE-2023-37857 : In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin p

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.

Published 2023-08-09 07:15:11

Updated 2023-11-14 10:15:29

Source CERT VDE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-37857

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-37857

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.8	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N	1.2	2.5	CERT VDE
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

Products affected by CVE-2023-37857

Phoenixcontact » Wp 6070-wvps Firmware
Versions before (<) 4.0.10
cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Phoenixcontact » Wp 6070-wvps » Version: N/A
Phoenixcontact » Wp 6101-wxps Firmware
Versions before (<) 4.0.10
cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Phoenixcontact » Wp 6101-wxps » Version: N/A
Phoenixcontact » Wp 6121-wxps Firmware
Versions before (<) 4.0.10
cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Phoenixcontact » Wp 6121-wxps » Version: N/A
Phoenixcontact » Wp 6156-whps Firmware
Versions before (<) 4.0.10
cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Phoenixcontact » Wp 6156-whps » Version: N/A
Phoenixcontact » Wp 6185-whps Firmware
Versions before (<) 4.0.10
cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Phoenixcontact » Wp 6185-whps » Version: N/A
Phoenixcontact » Wp 6215-whps Firmware
Versions before (<) 4.0.10
cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Phoenixcontact » Wp 6215-whps » Version: N/A

Vulnerability Details : CVE-2023-37857

Exploit prediction scoring system (EPSS) score for CVE-2023-37857

CVSS scores for CVE-2023-37857

CWE ids for CVE-2023-37857

References for CVE-2023-37857

Products affected by CVE-2023-37857