CVE-2023-51587

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-51587", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2023-12-20T20:38:20.870Z", "datePublished": "2024-05-03T02:15:17.846Z", "dateUpdated": "2024-08-02T22:40:34.098Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-05-03T02:15:17.846Z"}, "title": "Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability", "descriptions": [{"lang": "en", "value": "Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073."}], "affected": [{"vendor": "Voltronic Power", "product": "ViewPower", "versions": [{"version": "1.04.21353", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1892/", "name": "ZDI-23-1892", "tags": ["x_research-advisory"]}], "dateAssigned": "2023-12-20T20:45:49.345Z", "datePublic": "2023-12-20T23:09:31.186Z", "source": {"lang": "en", "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-51587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-03T18:48:56.263240Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:*:*:*:*"], "vendor": "voltronicpower", "product": "viewpower", "versions": [{"status": "affected", "version": "1.04.21353"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:20:20.379Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:40:34.098Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1892/", "name": "ZDI-23-1892", "tags": ["x_research-advisory", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1892/", "name": "ZDI-23-1892", "tags": ["x_research-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:40:34.098Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-51587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-03T18:48:56.263240Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:*:*:*:*"], "vendor": "voltronicpower", "product": "viewpower", "versions": [{"status": "affected", "version": "1.04.21353"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-03T18:58:45.920Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability", "source": {"lang": "en", "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "Voltronic Power", "product": "ViewPower", "versions": [{"status": "affected", "version": "1.04.21353"}], "defaultStatus": "unknown"}], "datePublic": "2023-12-20T17:09:31.186-06:00", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1892/", "name": "ZDI-23-1892", "tags": ["x_research-advisory"]}], "dateAssigned": "2023-12-20T14:45:49.345-06:00", "descriptions": [{"lang": "en", "value": "Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-05-03T02:15:17.846Z"}}}, "cveMetadata": {"cveId": "CVE-2023-51587", "state": "PUBLISHED", "dateUpdated": "2024-08-02T22:40:34.098Z", "dateReserved": "2023-12-20T20:38:20.870Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2024-05-03T02:15:17.846Z", "assignerShortName": "zdi"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "ViewPower", "vendor": "Voltronic Power", "versions": [{"status": "affected", "version": "1.04.21353"}]}], "source": "zdi-disclosures@trendmicro.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "viewpower", "vendor": "voltronicpower", "versions": [{"status": "affected", "version": "1.04.21353"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:-:*:*:*", "matchCriteriaId": "2CE4A520-86B5-4AE3-AD0E-7744328090E4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073."}, {"lang": "es", "value": "Vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n de autenticaci\u00f3n faltante en Voltronic Power ViewPower getModbusPassword. Esta vulnerabilidad permite a atacantes remotos revelar informaci\u00f3n confidencial sobre las instalaciones afectadas de Voltronic Power ViewPower. No se requiere autenticaci\u00f3n para aprovechar esta vulnerabilidad. La falla espec\u00edfica existe dentro del m\u00e9todo getModbusPassword. El problema se debe a la falta de autenticaci\u00f3n antes de permitir el acceso a la funcionalidad. Un atacante puede aprovechar esta vulnerabilidad para revelar las credenciales almacenadas, lo que provocar\u00eda un mayor commit. Era ZDI-CAN-22073."}], "id": "CVE-2023-51587", "lastModified": "2026-06-17T06:41:16.373", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-51587", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-03T18:48:56.263240Z", "version": "2.0.3"}}]}, "published": "2024-05-03T03:16:18.893", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1892/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1892/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{}