CVE-2023-51587CWE-306

Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability

High · published May 3, 2024

CVSS v3.0
7.5
EPSS
36%
Percentile
98.5
In the wild
Unconfirmed
What it is

Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getModbusPassword method. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22073.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.36038 · 98.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-05-03T02:15Z
EPSS history
Timeline
  • 03 MAY 02:15Z
    Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability
    cvelistv5