PT-2023-7104 · Unknown · Osprey Pump Controller

Published 2023-03-28 · Updated 2023-04-23 · CVE-2023-28654

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Osprey Pump Controller version 1.01

Description The issue is related to the use of hardcoded credentials in the Osprey Pump Controller software. This allows a remote attacker to gain full access to the web management interface configuration. The hidden administrative account is not visible in the Usernames and Passwords menu list of the application, and the password cannot be changed through any normal operation of the device.

Recommendations For Osprey Pump Controller version 1.01, as a temporary workaround, consider restricting access to the web management interface until a patch is available. Avoid using the default configuration and try to limit the exposure of the device to the network. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-259

Related Identifiers

BDU:2023-08131

CVE-2023-28654

Affected Products

Osprey Pump Controller

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28654 · Security Note
• https://bdu.fstec.ru/vul/2023-08131 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28654 · Vendor Advisory
• https://t.me/cibsecurity/60975 · Telegram Post
• https://t.me/cvenotify/47589 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-082-06 · Note