Vulnerability · Published Mar 28, 2023 · Assigned by icscert
CVE-2023-28398CVE-2023-28398
Critical 9.8
In plain English
A critical-severity security flaw in Osprey Pump Controller from ProPump and Controls, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Official description
Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat actor could exploit this vulnerability to create a user account without providing valid credentials. A threat actor who successfully exploits this vulnerability could gain access to the pump controller and cause disruption in operation, modify data, or shut down the controller.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ProPump and Controls, Inc. | Osprey Pump Controller | 1.01 |