Read the docs
TI-2023-19296 Aliases CVE-2023-37857GHSA-rq33-29r2-6jr3

PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels

Priority LOW 32CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00582 48th percentileScored 2026-11-07
Fix Fixed WP 6070-WVPS (PHOENIX CONTACT): 4.0.10WP 6101-WXPS (PHOENIX CONTACT): 4.0.10+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Phoenix ContactWP 6070-WVPSbefore 4.0.104.0.10Patch availableCNA
Phoenix ContactWP 6101-WXPSbefore 4.0.104.0.10Patch availableCNA
Phoenix ContactWP 6121-WXPSbefore 4.0.104.0.10Patch availableCNA
Phoenix ContactWP 6156-WHPSbefore 4.0.104.0.10Patch availableCNA
Phoenix ContactWP 6185-WHPSbefore 4.0.104.0.10Patch availableCNA
Phoenix ContactWP 6215-WHPSbefore 4.0.104.0.10Patch availableCNA
  • WP 6070-WVPS VendorPhoenix Contact Affected before 4.0.10 Fixed in 4.0.10 Patch available CNA
  • WP 6101-WXPS VendorPhoenix Contact Affected before 4.0.10 Fixed in 4.0.10 Patch available CNA
  • WP 6121-WXPS VendorPhoenix Contact Affected before 4.0.10 Fixed in 4.0.10 Patch available CNA
  • WP 6156-WHPS VendorPhoenix Contact Affected before 4.0.10 Fixed in 4.0.10 Patch available CNA
  • WP 6185-WHPS VendorPhoenix Contact Affected before 4.0.10 Fixed in 4.0.10 Patch available CNA
  • WP 6215-WHPS VendorPhoenix Contact Affected before 4.0.10 Fixed in 4.0.10 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:*before 4.0.10VulnerablePhoenixcontact
cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:*not specified by NVDRunning onPhoenixcontact
cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:*before 4.0.10VulnerablePhoenixcontact
cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:*not specified by NVDRunning onPhoenixcontact
cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:*before 4.0.10VulnerablePhoenixcontact
cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:*not specified by NVDRunning onPhoenixcontact
cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:*before 4.0.10VulnerablePhoenixcontact
cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:*not specified by NVDRunning onPhoenixcontact
cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:*before 4.0.10VulnerablePhoenixcontact
cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:*not specified by NVDRunning onPhoenixcontact
  • cpe:2.3:o:phoenixcontact:wp_6070-wvps_firmware:*:*:*:*:*:*:*:* Versions before 4.0.10 Vulnerable ·Phoenixcontact
  • cpe:2.3:h:phoenixcontact:wp_6070-wvps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
  • cpe:2.3:o:phoenixcontact:wp_6101-wxps_firmware:*:*:*:*:*:*:*:* Versions before 4.0.10 Vulnerable ·Phoenixcontact
  • cpe:2.3:h:phoenixcontact:wp_6101-wxps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
  • cpe:2.3:o:phoenixcontact:wp_6121-wxps_firmware:*:*:*:*:*:*:*:* Versions before 4.0.10 Vulnerable ·Phoenixcontact
  • cpe:2.3:h:phoenixcontact:wp_6121-wxps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
  • cpe:2.3:o:phoenixcontact:wp_6156-whps_firmware:*:*:*:*:*:*:*:* Versions before 4.0.10 Vulnerable ·Phoenixcontact
  • cpe:2.3:h:phoenixcontact:wp_6156-whps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
  • cpe:2.3:o:phoenixcontact:wp_6185-whps_firmware:*:*:*:*:*:*:*:* Versions before 4.0.10 Vulnerable ·Phoenixcontact
  • cpe:2.3:h:phoenixcontact:wp_6185-whps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:*before 4.0.10VulnerablePhoenixcontact
cpe:2.3:h:phoenixcontact:wp_6215-whps:-:*:*:*:*:*:*:*not specified by NVDRunning onPhoenixcontact
  • cpe:2.3:o:phoenixcontact:wp_6215-whps_firmware:*:*:*:*:*:*:*:* Versions before 4.0.10 Vulnerable ·Phoenixcontact
  • cpe:2.3:h:phoenixcontact:wp_6215-whps:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phoenixcontact

Remediation

  • Fix · CNA WP 6070-WVPS (PHOENIX CONTACT) Fixed in 4.0.10
  • Fix · CNA WP 6101-WXPS (PHOENIX CONTACT) Fixed in 4.0.10
  • Fix · CNA WP 6121-WXPS (PHOENIX CONTACT) Fixed in 4.0.10
  • Fix · CNA WP 6156-WHPS (PHOENIX CONTACT) Fixed in 4.0.10
  • Fix · CNA WP 6185-WHPS (PHOENIX CONTACT) Fixed in 4.0.10
  • Fix · CNA WP 6215-WHPS (PHOENIX CONTACT) Fixed in 4.0.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHOENIX CONTACT WP 6070-WVPS, WP 6101-WXPS and 4 more products 4.0.10

    10 records Highest priority Priority MEDIUM 3 MEDIUM, 7 LOW

    Other records, highest priority first

    • TI-2023-19301 PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panelsPriority MEDIUM 42
    • TI-2023-19300 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panelsPriority MEDIUM 42
    • TI-2023-19299 PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panelsPriority MEDIUM 40
    Show all 10 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37857
  2. 2026-10-03 Alias added: GHSA-rq33-29r2-6jr3

References

Advisory 1

  • TI-2014-07463 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function CVSS 2.0CRITICAL 10.0
  • TI-2024-17093 PHOENIX CONTACT: Remote code execution in CHARX Series CVSS 3.1CRITICAL 9.8
  • TI-2022-13692 Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers CVSS 3.1CRITICAL 9.8
  • TI-2026-21959 Remote code execution via uploading a malicious IODD file CVSS 3.1CRITICAL 9.8
  • TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
  • TI-2023-03334 PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels CVSS 3.1CRITICAL 10.0
See all 194 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences