Share: Email | Twitter

ID

VDE-2023-018

Published

2023-08-08 08:41 (CEST)

Last update

2023-08-08 08:41 (CEST)

Vendor(s)

PHOENIX CONTACT GmbH & Co. KG

Product(s)

Article No┬░ Product Name Affected Version(s)
1290800 WP 6070-WVPS < 4.0.10
1290801 WP 6101-WXPS < 4.0.10
1290802 WP 6121-WXPS < 4.0.10
1290803 WP 6156-WHPS < 4.0.10
1290807 WP 6185-WHPS < 4.0.10
1290809 WP 6215-WHPS < 4.0.10

Summary

Multiple vulnerabilities allow an attacker to read arbitrary files, inject commands and bypass authentication or access control. Furthermore, hardcoded session and encryption keys as well as a missing firmware update signature and a service running with unnecessary privileges were discovered.

Vulnerabilities



Last Update
Sept. 8, 2023, 10:13 a.m.
Weakness
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.

Last Update
Oct. 9, 2023, 9:28 a.m.
Weakness
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to the device.

Last Update
Aug. 8, 2023, 8:43 a.m.
Weakness
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated remote attacker can execute code with root permissions with a specially crafted HTTP POST when uploading a certificate to the device.
Last Update
Oct. 9, 2023, 9:30 a.m.
Weakness
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device.

Last Update
Oct. 9, 2023, 9:29 a.m.
Weakness
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device.

Last Update
Aug. 8, 2023, 8:43 a.m.
Weakness
Missing Authorization (CWE-862)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial denial-of-service.

Last Update
Oct. 9, 2023, 9:31 a.m.
Weakness
Missing Authorization (CWE-862)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon.

Last Update
Aug. 8, 2023, 8:43 a.m.
Weakness
Improper Privilege Management (CWE-269)
Summary
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string to execute system commands as root.
Last Update
Aug. 8, 2023, 8:43 a.m.
Weakness
Download of Code Without Integrity Check (CWE-494)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attackerwith SNMPv2 write privileges may use an a special SNMP request to gain full access to the device.

Last Update
Aug. 8, 2023, 8:43 a.m.
Weakness
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device.

Last Update
Nov. 14, 2023, 10:13 a.m.
Weakness
Use of Hard-coded Credentials (CWE-798)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.

Last Update
Aug. 8, 2023, 8:43 a.m.
Weakness
Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser.

Last Update
Aug. 8, 2023, 8:43 a.m.
Weakness
Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser .

Last Update
Nov. 14, 2023, 10:14 a.m.
Weakness
Use of Hard-coded Credentials (CWE-798)
Summary

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to obtain a valid session on the device.

Impact

These vulnerabilities allow an attacker to compromise the confidentiality, integrity and availability of the device. An authenticated attacker can gain an administrative shell, execute arbitrary OS commands with administrative privileges, read any files accessible for the “browser” user, craft valid session cookies, decrypt the password for web service, retrieve SNMP communities or craft a malicious firmware update packet.

Solution

Mitigation

Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:

Measures to protect network-capable devices with Ethernet connection

Remediation

Phoenix Contact strongly recommends updating to the latest Firmware Release 4.0.10 or higher, which fixes the above-mentioned vulnerabilities. 

Reported by

This vulnerability was discovered by Gabriele Quagliarella from Nozomi Networks Labs.

We kindly appreciate the coordinated disclosure of this vulnerability by the finder.

PHOENIX CONTACT thanks CERT@VDE for the coordination and support with this publication.