CVE-2023-37858
4.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Summary
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PHOENIX CONTACT | WP 6070-WVPS | 0 < 4.0.10 | affected |
| PHOENIX CONTACT | WP 6101-WXPS | 0 < 4.0.10 | affected |
| PHOENIX CONTACT | WP 6121-WXPS | 0 < 4.0.10 | affected |
| PHOENIX CONTACT | WP 6156-WHPS | 0 < 4.0.10 | affected |
| PHOENIX CONTACT | WP 6185-WHPS | 0 < 4.0.10 | affected |
| PHOENIX CONTACT | WP 6215-WHPS | 0 < 4.0.10 | affected |
Weaknesses
- CWE-311: CWE-311 Missing Encryption of Sensitive Data
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.