Vulnerability · Published May 3, 2024 · Assigned by zdi

CVE-2023-51587Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability

High 7.5

In plain English

A high-severity missing authentication in ViewPower from Voltronic Power. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 36.0% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)36.0%top 1.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073.

Affected products (as reported)

Vendor	Product	Versions
Voltronic Power	ViewPower	1.04.21353

Weakness: CWE-306 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ZDI-23-1892 x_research-advisory