CVE-2023-37857

LOW

3.8

Description

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.

Details CVE

Score CVSS v3.13.8

SeveriteLOW

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisHIGH

Interaction utilisateurNONE

Publie8/9/2023

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

phoenixcontact:wp_6070-wvpsphoenixcontact:wp_6070-wvps_firmwarephoenixcontact:wp_6101-wxpsphoenixcontact:wp_6101-wxps_firmwarephoenixcontact:wp_6121-wxpsphoenixcontact:wp_6121-wxps_firmwarephoenixcontact:wp_6156-whpsphoenixcontact:wp_6156-whps_firmwarephoenixcontact:wp_6185-whpsphoenixcontact:wp_6185-whps_firmwarephoenixcontact:wp_6215-whpsphoenixcontact:wp_6215-whps_firmware

Faiblesses (CWE)

CWE-798

References

https://cert.vde.com/en/advisories/VDE-2023-018/(info@cert.vde.com)

https://cert.vde.com/en/advisories/VDE-2023-018/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.