CVE-2023-51587
Assigner: zdi
Published: 2024-05-03T02:15:17.846Z
State: PUBLISHED
title: Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability
descriptions: value: Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073.
affected: vendor: Voltronic Power
product: ViewPower
versions: version: 1.04.21353
status: affected
defaultStatus: unknown
problemTypes: descriptions: cweId: CWE-306
description: CWE-306: Missing Authentication for Critical Function
type: CWE
dateAssigned: 2023-12-20T14:45:49.345-06:00
datePublic: 2023-12-20T17:09:31.186-06:00
source: value: 06fe5fd2bc53027c4a3b7e395af0b850e7b8a044
metrics: format: CVSS
cvssV3_0: version: 3.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH