CVE-2023-37857 - OpenCVE

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Phoenixcontact	Wp 6070-wvps Wp 6070-wvps Firmware Wp 6101-wxps Wp 6101-wxps Firmware Wp 6121-wxps Wp 6121-wxps Firmware Wp 6156-whps Wp 6156-whps Firmware Wp 6185-whps Wp 6185-whps Firmware Wp 6215-whps Wp 6215-whps Firmware

Configuration 1 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:h:phoenixcontact:wp_6215-whps:-:*:*:*:*:*:*:*

cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2023-018/

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2023-08-09T06:37:26.551Z

Updated: 2024-08-02T17:23:26.887Z

Reserved: 2023-07-10T07:53:04.115Z

Link: CVE-2023-37857

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-08-09T07:15:10.603

Modified: 2023-11-14T10:15:28.897

Link: CVE-2023-37857

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-37857", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-07-10T07:53:04.115Z", "datePublished": "2023-08-09T06:37:26.551Z", "dateUpdated": "2024-08-02T17:23:26.887Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WP 6070-WVPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6101-WXPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6121-WXPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6156-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6185-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6215-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Gabriele Quagliarella from Nozomi Networks Labs"}], "datePublic": "2023-08-08T06:45:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.<br>"}], "value": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-11-14T09:15:17.696Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-018/"}], "source": {"advisory": "VDE-2023-018", "defect": ["CERT@VDE#64468"], "discovery": "EXTERNAL"}, "title": "PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:26.887Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-018/", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:*", "matchCriteriaId": "7746DBEC-655D-4405-B457-202342434B49", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "30A330AB-B871-4312-927A-BF73D745DFD1", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:*", "matchCriteriaId": "04FBD160-0582-4049-B6F2-7A56CC056FF2", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4F5E047-4212-498C-8C8A-4454C53A34DD", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:*", "matchCriteriaId": "206E4626-E7B8-4744-A258-9B9941652018", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "75E09A8E-A36E-4E5D-A62F-A8DABAB4258F", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "7DF6A8F5-E997-4B75-BB55-4C77BE3011F6", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1859A631-9C2E-4AA6-BFA1-7DE9E779BD6E", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C60EBBD-552C-48AB-975E-C3B7D3009CC7", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2329179-AE02-4B31-A5FD-BD6E205726F7", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6215-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6CCE4E8-7EDF-44E9-8ED7-3FB88256674F", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D743C23B-054C-4F62-BCFB-BE90CF53832E", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.\n"}], "id": "CVE-2023-37857", "lastModified": "2023-11-14T10:15:28.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "info@cert.vde.com", "type": "Secondary"}]}, "published": "2023-08-09T07:15:10.603", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2023-018/"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "info@cert.vde.com", "type": "Primary"}]}