CVE-2023-37857
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
60/100
Published: 2023-08-09
Modified: 2026-11-10
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.
Weakness Classification (1)
Affected Software (6)
| Vendor | Product | Version |
|---|---|---|
| phoenixcontact | wp_6070-wvps_firmware | < 4.0.10 |
| phoenixcontact | wp_6101-wxps_firmware | < 4.0.10 |
| phoenixcontact | wp_6121-wxps_firmware | < 4.0.10 |
| phoenixcontact | wp_6156-whps_firmware | < 4.0.10 |
| phoenixcontact | wp_6185-whps_firmware | < 4.0.10 |
| phoenixcontact | wp_6215-whps_firmware | < 4.0.10 |
References & Advisories (1)
Third Party Advisory