Vulnerability · Published Aug 22, 2025 · Assigned by mitre
CVE-2022-31491
Critical 10.0
In plain English
A critical-severity code injection in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interface related to detection of a managed UPS shutting down. An unauthenticated attacker can use this to run arbitrary code immediately regardless of any managed UPS state or presence.
Affected products (as reported)
Weakness: CWE-749, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H