CVE-2023-3573: VDE-2023-018 | CERT@VDE

2023-08-08 08:41 (CEST) VDE-2023-018

PHOENIX CONTACT: Multiple vulnerabilities in WP 6xxx Web panels
Share: Email | Twitter

**

Published

**

2023-08-08 08:41 (CEST)

**

Last update

**

2023-08-08 08:41 (CEST)

Vendor(s)

PHOENIX CONTACT GmbH & Co. KG

Product(s)

Article No°

Product Name

Affected Version(s)

1290800

WP 6070-WVPS

< 4.0.10

1290801

WP 6101-WXPS

< 4.0.10

1290802

WP 6121-WXPS

< 4.0.10

1290803

WP 6156-WHPS

< 4.0.10

1290807

WP 6185-WHPS

< 4.0.10

1290809

WP 6215-WHPS

< 4.0.10

**

Summary

**

Multiple vulnerabilities allow an attacker to read arbitrary files, inject commands and bypass authentication or access control. Furthermore, hardcoded session and encryption keys as well as a missing firmware update signature and a service running with unnecessary privileges were discovered.

**

Vulnerabilities

**

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to the device.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.

Last Update

Aug. 8, 2023, 8:43 a.m.

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon.

Last Update

Aug. 8, 2023, 8:43 a.m.

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial denial-of-service.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Download of Code Without Integrity Check (CWE-494)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attackerwith SNMPv2 write privileges may use an a special SNMP request to gain full access to the device.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Improper Privilege Management (CWE-269)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string to execute system commands as root.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser .

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Use of Hard-coded Credentials (CWE-798)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. This issue cannot be exploited to bypass the web service authentication of the affected device(s).

Last Update

Aug. 8, 2023, 8:43 a.m.

Weakness

Use of Hard-coded Credentials (CWE-798)

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.

**

Impact

**

These vulnerabilities allow an attacker to compromise the confidentiality, integrity and availability of the device. An authenticated attacker can gain an administrative shell, execute arbitrary OS commands with administrative privileges, read any files accessible for the “browser” user, craft valid session cookies, decrypt the password for web service, retrieve SNMP communities or craft a malicious firmware update packet.

**

Solution

**

Mitigation

Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:

Measures to protect network-capable devices with Ethernet connection

Remediation

Phoenix Contact strongly recommends updating to the latest Firmware Release 4.0.10 or higher, which fixes the above-mentioned vulnerabilities.

**

Reported by

**

This vulnerability was discovered by Gabriele Quagliarella from Nozomi Networks Labs.

We kindly appreciate the coordinated disclosure of this vulnerability by the finder.

PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.