Osprey Pump Controller Firmware
CVE-2023-28395
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass. This may allow an attacker to hijack a session by predicting the session id and gain unauthorized access to the product.
AnalysisAI
Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-338. Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass. This may allow an attacker to hijack a session by predicting the session id and gain unauthorized access to the product. Affected products include: Propumpservice Osprey Pump Controller Firmware. Version information: version 1.01.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Osprey Pump Controller version 1.01 contains an unauthenticated command injection vulnerability that could allow system
Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full
Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication,
Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. Rated critic
Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. Rated critical
Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any che
Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure. Rated high severity (CVSS 7.5),
Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today