No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Simon Janz (@esj4y) (Trend Micro's Zero Day Initiative)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2023-51570 | CWE-502 Deserialization of Untrusted Data | 9.8 Critical |
The affected product deserializes untrusted data without sufficiently verifying the resulting data will be valid. Mitigation: Voltronic Power did not respond to CISA's attempts at coordination. Users of Voltronic Power products are encouraged to contact Voltronic Power and keep their systems up to date. Affected, fixed & timelineAffected:
|
| CVE-2023-51572 | CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 9.8 Critical |
The affected product is vulnerable to an OS command injection, which may allow remote code execution on the underlying operating system. Mitigation: Voltronic Power did not respond to CISA's attempts at coordination. Users of Voltronic Power products are encouraged to contact Voltronic Power and keep their systems up to date. Affected, fixed & timelineAffected:
|
| CVE-2023-51573 | CWE-749 Exposed Dangerous Method or Function | 9.8 Critical |
The affected product allows an unauthenticated user to invoke a method that may modify the administrator account password. Mitigation: Voltronic Power did not respond to CISA's attempts at coordination. Users of Voltronic Power products are encouraged to contact Voltronic Power and keep their systems up to date. Affected, fixed & timelineAffected:
|
| CVE-2023-51571 | CWE-306 Missing Authentication for Critical Function | 7.5 High |
When a specific service of the affected product receives a certain message from an unauthenticated user, that process may stop. Mitigation: Voltronic Power did not respond to CISA's attempts at coordination. Users of Voltronic Power products are encouraged to contact Voltronic Power and keep their systems up to date. Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2023-51570 | 9.8 Critical | Voltronic Power ViewPower Pro Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
| CVE-2023-51572 | 9.8 Critical | Voltronic Power ViewPower Pro Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to … |
| CVE-2023-51573 | 9.8 Critical | Voltronic Power ViewPower Pro Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability. This vulnerability allows remote … |
| CVE-2023-51571 | 7.5 High | Voltronic Power ViewPower Pro Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to cre… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.