PT-2023-8672 · Unknown · Osprey Pump Controller

Gjoko Krstic · Published 2023-03-28 · Updated 2023-04-05 · CVE-2023-28718

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Osprey Pump Controller version 1.01

Description The issue is related to the lack of verification for HTTP requests, which may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website. This can be exploited by sending specially crafted HTTP requests, potentially allowing a remote attacker to execute arbitrary commands.

Recommendations For Osprey Pump Controller version 1.01, consider restricting access to administrative functions until a patch is available, and avoid using the controller to perform sensitive actions when logged in and visiting external websites. As a temporary workaround, restrict the use of HTTP requests to only necessary functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-01487

CVE-2023-28718

Affected Products

Osprey Pump Controller

References · 5

• https://bdu.fstec.ru/vul/2024-01487 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28718 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-082-06 · Note
• https://t.me/cvenotify/47587 · Telegram Post