PT-2023-7476 · Unknown · Osprey Pump Controller

Published 2023-03-23 · Updated 2023-04-05 · CVE-2023-28395

Positive Technologies (AI Summary)

CVSS v2.0

9.7

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Osprey Pump Controller version 1.01

Description The issue is related to a weak session token generation algorithm that can be predicted, potentially allowing an attacker to hijack a session by predicting the session id and gain unauthorized access to the product. This is due to insufficient entropy in the session token generation. The vulnerability may be exploited by a remote attacker to gain unauthorized access to the device.

Recommendations For Osprey Pump Controller version 1.01, consider implementing additional security measures to protect against session hijacking, such as enhancing the session token generation algorithm to increase entropy and make it more difficult to predict. As a temporary workaround, restrict access to sensitive areas of the product to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-338

CWE-331

Related Identifiers

BDU:2023-08520

CVE-2023-28395

Affected Products

Osprey Pump Controller

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28395 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28395 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08520 · Security Note
• https://vuldb.com/fr/?id.223789 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-082-06 · Note
• https://t.me/cvenotify/47556 · Telegram Post