CVE-2023-37863: PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels - Vulnerability Platform

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2023-37863

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels

Source: NVD (National Vulnerability Database)

Vulnerability Description

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device.

Source: NVD (National Vulnerability Database)

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: NVD (National Vulnerability Database)

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: NVD (National Vulnerability Database)

Vulnerability Title

PHOENIX CONTACTs WP 6xxx series web panels 操作系统命令注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

PHOENIX CONTACTs WP 6xxx series web panels是德国菲尼克斯电气（PHOENIX CONTACTs）公司的一系列网页面板。 PHOENIX CONTACTs WP 6xxx series web panels 4.0.10 之前版本存在操作系统命令注入漏洞，该漏洞源于在Web 面板中，具有 SNMPv2 写入权限的远程攻击者可以使用特殊的 SNMP 请求来获得对设备的完全访问权限。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
PHOENIX CONTACT	WP 6070-WVPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6101-WXPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6121-WXPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6156-WHPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6185-WHPS	0 ~ 4.0.10	-
PHOENIX CONTACT	WP 6215-WHPS	0 ~ 4.0.10	-

II. Public POCs for CVE-2023-37863

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-37863

Please Login to view more intelligence information

IV. Related Vulnerabilities

Same product: WP 6070-WVPS

Same vendor: PHOENIX CONTACT

Same weakness: CWE-78

V. Comments for CVE-2023-37863

No comments yet

Leave a comment