Dashboard / CVE-2023-37858

CVE-2023-37858

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 55/100
Published: 2023-08-09 Modified: 2026-11-10 First seen: 2026-11-10 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: None
A: None

Description

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
phoenixcontact wp_6070-wvps_firmware < 4.0.10
phoenixcontact wp_6101-wxps_firmware < 4.0.10
phoenixcontact wp_6121-wxps_firmware < 4.0.10
phoenixcontact wp_6156-whps_firmware < 4.0.10
phoenixcontact wp_6185-whps_firmware < 4.0.10
phoenixcontact wp_6215-whps_firmware < 4.0.10

References & Advisories (1)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.45%
Raw Score 0.004540
Percentile 39.9%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00454
2026-11-13
0.00454
2026-11-12
0.00454
2026-11-10
0.00454
2026-11-09
0.00454

Intelligence Sources

nvd ref →

External Links