CVE-2023-28398 CRITICAL

CVE-2023-28398: CVE-2023-28398

Vendor Propump And Controls, Inc.
Product Osprey Pump Controller
Published March 28, 2023
Last update January 16, 2025

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat actor could exploit this vulnerability to create a user account without providing valid credentials. A threat actor who successfully exploits this vulnerability could gain access to the pump controller and cause disruption in operation, modify data, or shut down the controller.

Key dates

02Disclosure timeline

March 28, 2023 CVE published
January 16, 2025 Record updated