CVE-2023-51587

EPSS 8.12%
Veröffentlicht 03.05.2024 03:16:18
Zuletzt bearbeitet 09.07.2025 16:58:28
Quelle zdi-disclosures@trendmicro.com
CVE-Watchlists
Login
Unerledigt
Login

Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Voltronicpower ≫ Viewpower Version1.04.21353 SwEdition-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	8.12%	0.918

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
zdi-disclosures@trendmicro.com	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://www.zerodayinitiative.com/advisories/ZDI-23-1892/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-51587

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-51587

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-51587

EUVD