CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting this these vulnerabilities has been reported to CISA at this time.
Credit: an anonymous researcher
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2022-31491 | CWE-749 Exposed Dangerous Method or Function | 10.0 Critical |
The UPS management software normally allows a properly authenticated and authorized user using a web interface to configure the system to run a single OS command of the users choosing when the software detects a managed UPS is shutting down. A related critical underlying function is exposed over the network with no authentication or authorization allowing an attacker to use this to run arbitrary code immediately regardless of any managed UPS state or presence. Mitigation: Voltronic Power has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of these affected products are invited to contact Voltronic Power customer support for additional information. ↗ Mitigation: Powershield is aware of the issue and has provided a fix in NetGuard versions 1.04-23292 and later. For more information, refer to Powershield's software page. User can also contact Powershield via email or phone: +618 9209 3839. ↗ Mitigation: Powershield is aware of the issue and has provided a fix in NetGuard versions 1.04-23292 and later. For more information, refer to Powershield's software page. User can also contact Powershield via email or phone: +618 9209 3839. ↗ Affected, fixed & timelineAffected:
|
| CVE-2021-43110 | CWE-425 Direct Request ('Forced Browsing') | 9.8 Critical |
The UPS management software is supposed to only allow a properly authenticated and authorized admin user using a web interface to configure the system. An unauthenticated remote attacker can make changes to the system including: changing the web interface admin password, view/change system configuration, enumerate connected UPS devices and shut down connected UPS devices. Mitigation: Voltronic Power has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of these affected products are invited to contact Voltronic Power customer support for additional information. ↗ Mitigation: Powershield is aware of the issue and has provided a fix in NetGuard versions 1.04-23292 and later. For more information, refer to Powershield's software page. User can also contact Powershield via email or phone: +618 9209 3839. ↗ Mitigation: Powershield is aware of the issue and has provided a fix in NetGuard versions 1.04-23292 and later. For more information, refer to Powershield's software page. User can also contact Powershield via email or phone: +618 9209 3839. ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2022-31491 | 10.0 Critical | n/a n/a Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to… |
| CVE-2021-43110 | — | n/a n/a An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products. |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.