CVE-2023-37855: PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels - Vulnerability Platform

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2023-37855

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels

Source: NVD (National Vulnerability Database)

Vulnerability Description

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.

Source: NVD (National Vulnerability Database)

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: NVD (National Vulnerability Database)

Vulnerability Type

资源在另一范围的外部可控制索引

Source: NVD (National Vulnerability Database)

Vulnerability Title

PHOENIX CONTACTs WP 6xxx series web panels 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

PHOENIX CONTACTs WP 6xxx series web panels是德国菲尼克斯电气（PHOENIX CONTACTs）公司的一系列网页面板。 PHOENIX CONTACT WP 6xxx 系列 4.0.10 之前版本存在安全漏洞，该漏洞源于在Web 面板中，具有低权限的远程攻击者能够获得对嵌入式 Qt 浏览器内的设备文件系统的有限读取访问权限。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
PHOENIX CONTACT	WP 6070-WVPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6101-WXPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6121-WXPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6156-WHPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6185-WHPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6215-WHPS	0 ~ 4.0.10	-

II. Public POCs for CVE-2023-37855

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-37855

Please Login to view more intelligence information

IV. Related Vulnerabilities

Same product: WP 6070-WVPS

Same vendor: PHOENIX CONTACT

Same weakness: CWE-610

V. Comments for CVE-2023-37855

No comments yet

Leave a comment