CVE-2023-37861CWE-78

PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels

High · published August 9, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00881 · 58.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-08-09T06:34Z
EPSS history
Timeline
  • 09 AUG 06:34Z
    PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
    cvelistv5