PHOENIX CONTACT: Command Injection in WP 6xxx Web panels

Vulnerability

A command injection vulnerability exists in the HTTP POST request handling font configuration operations in PHOENIX CONTACT WP 6xxx series web panels prior to version 4.0.10. A remote attacker with low privileges can inject arbitrary OS commands through the font configuration parameters, exploiting insufficient input validation [1].

Exploitation

An attacker needs a valid low-privileged session to the web interface. By sending a specially crafted HTTP POST request to the font configuration endpoint, the attacker can inject and execute arbitrary OS commands with administrative privileges [1].

Impact

Successful exploitation grants the attacker full control over the device, including the ability to execute arbitrary OS commands, read or modify files, and compromise confidentiality, integrity, and availability [1].

Mitigation

The vulnerability is fixed in firmware version 4.0.10. Users should update to the latest version. No workaround is available [1].