CVE-2023-37858
Assigner: CERTVDE
Published: 2023-08-09T06:37:48.351Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: WP 6070-WVPS
vendor: PHOENIX CONTACT
versions: lessThan: 4.0.10
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: WP 6101-WXPS
vendor: PHOENIX CONTACT
versions: lessThan: 4.0.10
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: WP 6121-WXPS
vendor: PHOENIX CONTACT
versions: lessThan: 4.0.10
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: WP 6156-WHPS
vendor: PHOENIX CONTACT
versions: lessThan: 4.0.10
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: WP 6185-WHPS
vendor: PHOENIX CONTACT
versions: lessThan: 4.0.10
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: WP 6215-WHPS
vendor: PHOENIX CONTACT
versions: lessThan: 4.0.10
status: affected
version: 0
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Gabriele Quagliarella from Nozomi Networks Labs
datePublic: 2023-08-08T06:45:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.<br><br>
value: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
type: CWE
source: advisory: VDE-2023-018
defect: CERT@VDE#64468
discovery: EXTERNAL
title: PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels
x_generator: engine: Vulnogram 0.1.0-dev