CVE-2023-37862

HighCVSS 8.2/10Last modified Nov 10, 2026

Description

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial denial-of-service.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
PHOENIX CONTACT	WP 6070-WVPS	< 4.0.10
PHOENIX CONTACT	WP 6101-WXPS	< 4.0.10
PHOENIX CONTACT	WP 6121-WXPS	< 4.0.10
PHOENIX CONTACT	WP 6156-WHPS	< 4.0.10
PHOENIX CONTACT	WP 6185-WHPS	< 4.0.10
PHOENIX CONTACT	WP 6215-WHPS	< 4.0.10
phoenixcontact	wp_6070-wvps	< 4.0.10
phoenixcontact	wp_6101-wxps	< 4.0.10
phoenixcontact	wp_6121-wxps	< 4.0.10
phoenixcontact	wp_6156-whps	< 4.0.10
phoenixcontact	wp_6185-whps	< 4.0.10
phoenixcontact	wp_6215-whps	< 4.0.10

References

https://cert.vde.com/en/advisories/VDE-2023-018/Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2023-018/Third Party Advisory

Timeline

Published: Aug 9, 2023
Last modified: Nov 10, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-378637.2In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a specia CVE-2023-378647.2In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a specia CVE-2023-378655.3Authentication Bypass by Spoofing vulnerability in IP2Location Download IP2Location Country Blocker allows Accessing Functionality Not Prope CVE-2023-378667.2Improper Privilege Management vulnerability in Crocoblock JetFormBuilder allows Privilege Escalation.This issue affects JetFormBuilder: from CVE-2023-378678.1Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordP CVE-2023-378686.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO:CVE-2023-378698.8Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.CVE-2023-37875.4A vulnerability classified as problematic was found in Codecanyon Tiva Events Calender 1.4. This vulnerability affects unknown code. The man CVE-2023-378708.1Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through CVE-2023-378717.5Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5 CVE-2023-378726.5Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses:CVE-2023-378736.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.