CVE-2023-51573: Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers…

PriorityP182critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EPSS

45.74%

98.6th percentile

Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The specific flaw exists within the updateManagerPassword function. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21203.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
voltronic_power	viewpower_pro	—	—
voltronicpower	viewpower	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Target function: unauthenticated invocation of updateManagerPassword function allows modification of the administrator account password — detect unauthenticated calls to this method on ViewPower Pro installations ↗
→No authentication required to exploit — any network-originated request reaching the updateManagerPassword function without prior authentication should be treated as suspicious ↗
→Affected version for scoping detection: Voltronic Power ViewPower Pro version 2.0-22165 is the confirmed vulnerable release ↗
→Network-reachable attack surface: vulnerability is exploitable remotely with low attack complexity — prioritize monitoring of ViewPower Pro network listeners exposed beyond the local network segment ↗

·Vendor (Voltronic Power) did not respond to CISA coordination attempts — no official patch or fixed version has been confirmed; no vendor-supplied mitigations are available ↗
·No known public exploitation has been reported at time of advisory publication — threat intelligence on active campaigns is absent from available sources ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.