CVE-2023-37855 - OpenCVE

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Phoenixcontact	Wp 6185-whps Firmware Wp 6156-whps Wp 6070-wvps Wp 6215-whps Wp 6156-whps Firmware Wp 6070-wvps Firmware Wp 6101-wxps Wp 6215-whps Firmware Wp 6185-whps Wp 6121-wxps Wp 6121-wxps Firmware Wp 6101-wxps Firmware

Configuration 1 [-]

AND

cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:phoenixcontact:wp_6215-whps:-:*:*:*:*:*:*:*

References

Link	Resource
https://cert.vde.com/en/advisories/VDE-2023-018/	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: CERTVDE

Published: 2023-08-09T06:37:07.620Z

Updated: 2023-08-09T06:37:07.620Z

Reserved: 2023-07-10T07:53:04.114Z

Link: CVE-2023-37855

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-08-09T07:15:10.380

Modified: 2023-08-15T17:54:28.870

Link: CVE-2023-37855

JSON object: View

Redhat Information

No data.

CWE

CWE-610

{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-37855", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-07-10T07:53:04.114Z", "datePublished": "2023-08-09T06:37:07.620Z", "dateUpdated": "2023-08-09T06:37:07.620Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WP 6070-WVPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6101-WXPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6121-WXPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6156-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6185-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WP 6215-WHPS", "vendor": "PHOENIX CONTACT", "versions": [{"lessThan": "4.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Gabriele Quagliarella from Nozomi Networks Labs"}], "datePublic": "2023-08-08T06:45:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.</span><br>"}], "value": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-610", "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-08-09T06:37:07.620Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-018/"}], "source": {"advisory": "VDE-2023-018", "defect": ["CERT@VDE#64468"], "discovery": "EXTERNAL"}, "title": "PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "30A330AB-B871-4312-927A-BF73D745DFD1", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:*", "matchCriteriaId": "7746DBEC-655D-4405-B457-202342434B49", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4F5E047-4212-498C-8C8A-4454C53A34DD", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:*", "matchCriteriaId": "04FBD160-0582-4049-B6F2-7A56CC056FF2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "75E09A8E-A36E-4E5D-A62F-A8DABAB4258F", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:*", "matchCriteriaId": "206E4626-E7B8-4744-A258-9B9941652018", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1859A631-9C2E-4AA6-BFA1-7DE9E779BD6E", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "7DF6A8F5-E997-4B75-BB55-4C77BE3011F6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2329179-AE02-4B31-A5FD-BD6E205726F7", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C60EBBD-552C-48AB-975E-C3B7D3009CC7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D743C23B-054C-4F62-BCFB-BE90CF53832E", "versionEndExcluding": "4.0.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:phoenixcontact:wp_6215-whps:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6CCE4E8-7EDF-44E9-8ED7-3FB88256674F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.\n"}], "id": "CVE-2023-37855", "lastModified": "2023-08-15T17:54:28.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "info@cert.vde.com", "type": "Primary"}]}, "published": "2023-08-09T07:15:10.380", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2023-018/"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-610"}], "source": "info@cert.vde.com", "type": "Primary"}]}