CVE-2023-51571
published 2024-04-01CVE-2023-51571: Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a…
PriorityP344high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
0.67%
47.2th percentile
Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the SocketService module, which listens on UDP port 41222 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-21162.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| voltronic_power | viewpower_pro | — | — |
| voltronicpower | viewpower | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5vqg-cq3h-mm9v: Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability
ghsa_unreviewed·2024-04-02
CVE-2023-51571 [HIGH] CWE-306 GHSA-5vqg-cq3h-mm9v: Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability
Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the SocketService module, which listens on UDP port 41222 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-21162.
CISA ICS
Voltronic Power ViewPower Pro
cisa_ics·2024-01-23·CVSS 9.8
[CRITICAL] Voltronic Power ViewPower Pro
ICS Advisory
##
Voltronic Power ViewPower Pro
Release DateJanuary 23, 2024
Alert CodeICSA-24-023-03
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/Low attack complexity
- Vendor: Voltronic Power
- Equipment: ViewPower Pro
- Vulnerabilities: Deserialization of Untrusted Data, Missing Authentication for Critical Function, Exposed Dangerous Method or Function, OS Command Injection
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to create a denial-of-service condition, obtain administrator credentials, or achieve remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of ViewPower Pro, an Uninterruptable Power Supply (UPS) management soft
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-01
Published