High severity · published Mar 28, 2023
CVE-2023-28718
No description published yet
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Osprey Pump Controller · ProPump and Controls, Inc.
1.01 · source: vendor
OP
Osprey Pump Controller Firmware · Propumpservice
1.01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28718
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
More from Osprey Pump Controller
9.8
CVE-2023-28712
No description published yet
9.8
CVE-2023-28398
No description published yet
9.8
CVE-2023-27394
No description published yet
9.8
CVE-2023-27886
No description published yet
9.8
CVE-2023-28654
No description published yet