Remote Code Execution Vulnerability in Voltronic Power ViewPower Pro

CVE-2023-51585

What is CVE-2023-51585?

A command injection vulnerability exists in the Voltronic Power ViewPower USBCommEx that allows remote attackers to execute arbitrary code on affected installations. The flaw arises from inadequate validation of a user-supplied string in the shutdown method. Successful exploitation requires user interaction, as an administrator must initiate a shutdown command. This oversight can be leveraged by attackers who can execute code in the context of the current user, posing a significant risk to system integrity. For more detailed information, refer to the ZDI advisory ZDI-23-1890.

References