« Volver al listado

CVE-2023-51587

Estado: AnalizadaAlta (7.5)—

Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Voltronicpower — Viewpower

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-51587",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-51587",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-03T18:48:56.263240Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Voltronic Power",
          "product": "ViewPower",
          "versions": [
            {
              "status": "affected",
              "version": "1.04.21353"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:*:*:*:*"
          ],
          "vendor": "voltronicpower",
          "product": "viewpower",
          "versions": [
            {
              "status": "affected",
              "version": "1.04.21353"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-03T03:16:18.893",
  "references": [
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1892/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1892/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de divulgación de información de autenticación faltante en Voltronic Power ViewPower getModbusPassword. Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de Voltronic Power ViewPower. No se requiere autenticación para aprovechar esta vulnerabilidad. La falla específica existe dentro del método getModbusPassword. El problema se debe a la falta de autenticación antes de permitir el acceso a la funcionalidad. Un atacante puede aprovechar esta vulnerabilidad para revelar las credenciales almacenadas, lo que provocaría un mayor commit. Era ZDI-CAN-22073."
    }
  ],
  "lastModified": "2026-06-17T06:41:16.373",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CE4A520-86B5-4AE3-AD0E-7744328090E4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}