CVE-2023-3572 - OpenCVE

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Phoenixcontact	Wp 6070-wvps Wp 6070-wvps Firmware Wp 6101-wxps Wp 6101-wxps Firmware Wp 6121-wxps Wp 6121-wxps Firmware Wp 6156-whps Wp 6156-whps Firmware Wp 6185-whps Wp 6185-whps Firmware Wp 6215-whps Wp 6215-whps Firmware

Configuration 1 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6215-whps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2023-018/

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2023-08-08T06:52:29.820Z

Updated: 2024-08-02T07:01:55.922Z

Reserved: 2023-07-10T07:53:13.476Z

Link: CVE-2023-3572

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-08-08T07:15:10.840

Modified: 2023-09-08T09:15:07.390

Link: CVE-2023-3572

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3572", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-07-10T07:53:13.476Z", "datePublished": "2023-08-08T06:52:29.820Z", "dateUpdated": "2024-08-02T07:01:55.922Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WP 6070-WVPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6101-WXPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6121-WXPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6156-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6185-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6215-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Gabriele Quagliarella from Nozomi Networks Labs"}], "datePublic": "2023-08-08T06:45:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device."}], "value": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-09-08T08:12:15.705Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-018/"}], "source": {"advisory": "VDE-2023-018", "defect": ["CERT@VDE#64468"], "discovery": "EXTERNAL"}, "title": "PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:01:55.922Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-018/", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:*", "matchCriteriaId": "7746DBEC-655D-4405-B457-202342434B49", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "30A330AB-B871-4312-927A-BF73D745DFD1", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:*", "matchCriteriaId": "04FBD160-0582-4049-B6F2-7A56CC056FF2", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4F5E047-4212-498C-8C8A-4454C53A34DD", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:*", "matchCriteriaId": "206E4626-E7B8-4744-A258-9B9941652018", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "75E09A8E-A36E-4E5D-A62F-A8DABAB4258F", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "7DF6A8F5-E997-4B75-BB55-4C77BE3011F6", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1859A631-9C2E-4AA6-BFA1-7DE9E779BD6E", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C60EBBD-552C-48AB-975E-C3B7D3009CC7", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2329179-AE02-4B31-A5FD-BD6E205726F7", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6215-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6CCE4E8-7EDF-44E9-8ED7-3FB88256674F", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D743C23B-054C-4F62-BCFB-BE90CF53832E", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device."}], "id": "CVE-2023-3572", "lastModified": "2023-09-08T09:15:07.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "info@cert.vde.com", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2023-08-08T07:15:10.840", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2023-018/"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "info@cert.vde.com", "type": "Primary"}]}