Paper/Archive/CVE-2023-28654

CVE-2023-28654

ProPump and Controls, Inc. Osprey Pump Controller — CVE-2023-28654

CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 55.7.557 × 2011.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and the password cannot be changed through any normal operation of the device.

Affected

ProductAffectedFixed inSource

Osprey Pump Controller1.01–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-082-06