CVE-2023-37862

published 2023-08-09

CVE-2023-37862: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This…

high 8.2 CVSS 3.1

AV N AC L PR N UI N S U C N I H A L

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial denial-of-service.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
phoenix_contact	wp_6070-wvps	< 4.0.10	4.0.10
phoenix_contact	wp_6101-wxps	< 4.0.10	4.0.10
phoenix_contact	wp_6121-wxps	< 4.0.10	4.0.10
phoenix_contact	wp_6156-whps	< 4.0.10	4.0.10
phoenix_contact	wp_6185-whps	< 4.0.10	4.0.10
phoenix_contact	wp_6215-whps	< 4.0.10	4.0.10
phoenixcontact	wp_6070-wvps_firmware	< 4.0.10	4.0.10
phoenixcontact	wp_6101-wxps_firmware	< 4.0.10	4.0.10
phoenixcontact	wp_6121-wxps_firmware	< 4.0.10	4.0.10
phoenixcontact	wp_6156-whps_firmware	< 4.0.10	4.0.10
phoenixcontact	wp_6185-whps_firmware	< 4.0.10	4.0.10
phoenixcontact	wp_6215-whps_firmware	< 4.0.10	4.0.10

CWE-862