title: PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels
description: In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.
problem types: CWE-311 Missing Encryption of Sensitive Data
affected:
{
defaultStatus: unaffected
product: WP 6070-WVPS
vendor: PHOENIX CONTACT
versions:
lessThan: 4.0.10, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: WP 6101-WXPS
vendor: PHOENIX CONTACT
versions:
lessThan: 4.0.10, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: WP 6121-WXPS
vendor: PHOENIX CONTACT
versions:
lessThan: 4.0.10, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: WP 6156-WHPS
vendor: PHOENIX CONTACT
versions:
lessThan: 4.0.10, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: WP 6185-WHPS
vendor: PHOENIX CONTACT
versions:
lessThan: 4.0.10, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: WP 6215-WHPS
vendor: PHOENIX CONTACT
versions:
lessThan: 4.0.10, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL