Remote Code Execution Vulnerability in Voltronic Power ViewPower Pro
CVE-2023-51595

9.8CRITICAL

Key Information:

Vendor

Voltronic Power

Status
VieWPower Pro
Vendor
CVE Published:
3 May 2024

What is CVE-2023-51595?

The ViewPower Pro software by Voltronic contains a SQL Injection vulnerability that allows remote attackers to perform arbitrary code execution. The flaw is found in the selectDeviceListBy method, where user input is not properly validated prior to being used in SQL query construction. This oversight enables potential attackers to execute code in the context of the LOCAL SERVICE without requiring authentication, posing a significant security threat to installations of the affected software.

Affected Version(s)

ViewPower Pro 2.0-22165

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1897/
x_research-advisory

EPSS Score

48% chance of being exploited in the next 30 days.

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.