PT-2022-10017 · Viewpower · Upsmonitor

Pedro Sousa Rodrigues + 1 · Published 2022-08-16 · Updated 2022-08-17 · CVE-2021-30490

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions upsMonitor in ViewPower (aka ViewPowerHTML) versions 1.04-21012 through 1.04-21353

Description The issue is related to insecure permissions for the service binary, allowing an authenticated user to modify files and enabling privilege escalation.

Recommendations For versions 1.04-21012 through 1.04-21353, consider restricting access to the service binary to prevent modification by authenticated users until a patch is available. As a temporary workaround, limit the privileges of the authenticated users to minimize the risk of exploitation.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-30490

Affected Products

Upsmonitor

References · 6

• 🔥 https://0x90.zone/binary/reverse/exploitation/2020/08/16/Privilege-Escalation-ViewPower.html · Exploit
• https://power-software-download.com/viewpower.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30490 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30490 · Vendor Advisory
• https://t.me/cibsecurity/48213 · Telegram Post
• https://t.me/cvenotify/34808 · Telegram Post