ProPump and Controls Osprey Pump Controller (Update A)
Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access, retrieve sensitive information, modify data, cause a denial-of-service, and/or gain administrative control.
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-28718US | high8.0 | — | ||
Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to pe… | ||||
| CVE-2023-28712US | critical9.8 | — | ||
Osprey Pump Controller version 1.01 contains an unauthenticated command injection vulnerability that could allow system access with www-data permissions. | ||||
| CVE-2023-28654US | critical9.8OT elevated | — | ||
Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The u… | ||||
| CVE-2023-28648US | medium6.1 | — | ||
Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/J… | ||||
| CVE-2023-28398US | critical9.8OT elevated | — | ||
Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat… | ||||
| CVE-2023-28375US | high7.5 | — | ||
Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure. Using a GET parameter, attackers can disclose arbitrary files on the affected device and di… | ||||
| CVE-2023-27886US | critical9.8 | — | ||
Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands thr… | ||||
| CVE-2023-27394US | critical9.8 | — | ||
Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands throug… | ||||
| CVE-2023-28395US | high7.5 | — | ||
Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass. This ma… | ||||
references
External citations — patches, advisories, analysis.
- Recommended Practicesexternal
- ICS Advisory ICSA-23-082-06 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-23-082-06 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (9)
- MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/ - MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/ - MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/ - MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/ - MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/ - MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/ - MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/ - MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/ - MitigationOsprey Pump Controller
ProPump and Controls has released version 20230518 of their product and recommends updating to this version or later. ProPump and Controls has reported the update has fixed the reported vulnerabilities. Users are encouraged to contact ProPump and Controls representative for assistance in ensuring they are up to date with the latest release. No user-initiated update process is available.
https://propumpservice.com/find-your-sales-rep/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan