CVE-2023-51576: falha crítica em Voltronic Power ViewPower
Voltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 1.5%
Voltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the RMI interface, which listens on TCP port 51099 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22012.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Voltronic Power · ViewPowerCVEs relacionadas — Voltronic Power ViewPower
No mesmo produto, das mais perigosas para as menos.
CVE-2023-51587HIGHVoltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure VulnerabilityEPSS 36.0%CVE-2023-51574CRITICALVoltronic Power ViewPower updateManagerPassword Exposed Dangerous Method Authentication Bypass VulnerabilityEPSS 1.6%CVE-2023-51583CRITICALVoltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-51582CRITICALVoltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-51581CRITICALVoltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.5%CVE-2023-51575CRITICALVoltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 1.5%