CVE-2023-37858 json
PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels
published 2023-08-09 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-41732
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.
Patch / fix
- PHOENIX CONTACT WP 6070-WVPS 4.0.10
- PHOENIX CONTACT WP 6101-WXPS 4.0.10
- PHOENIX CONTACT WP 6121-WXPS 4.0.10
- PHOENIX CONTACT WP 6156-WHPS 4.0.10
- PHOENIX CONTACT WP 6185-WHPS 4.0.10
- PHOENIX CONTACT WP 6215-WHPS 4.0.10
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Affected products
- PHOENIX CONTACT WP 6070-WVPS
- PHOENIX CONTACT WP 6101-WXPS
- PHOENIX CONTACT WP 6121-WXPS
- PHOENIX CONTACT WP 6156-WHPS
- PHOENIX CONTACT WP 6185-WHPS
- PHOENIX CONTACT WP 6215-WHPS
Classification
- Weakness
-
- CWE-311 Missing Encryption of Sensitive Data
References
-
cert.vde.com
/en/advisories/VDE-2023-018/
third-party-advisory
Sources
- CVE List CVE-2023-37858
- NVD CVE-2023-37858
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.