cvelistv5 - cve-2023-51585

CVE-2023-51585 (GCVE-0-2023-51585)

Vulnerability from cvelistv5 – Published: 2024-05-03 02:15 – Updated: 2024-08-02 22:40

Title

Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability

Summary

Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation. The specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071.

Severity ?

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	Voltronic Power	ViewPower	Affected: 1.04.21353

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:power-software-download:viewpower:1.04-21353:*:*:*:-:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "viewpower",
            "vendor": "power-software-download",
            "versions": [
              {
                "status": "affected",
                "version": "1.04-21353"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-51585",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-03T14:31:41.131860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:21:03.536Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:40:33.849Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-23-1890",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1890/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ViewPower",
          "vendor": "Voltronic Power",
          "versions": [
            {
              "status": "affected",
              "version": "1.04.21353"
            }
          ]
        }
      ],
      "dateAssigned": "2023-12-20T14:45:49.332-06:00",
      "datePublic": "2023-12-20T17:09:26.569-06:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.\n\nThe specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-03T02:15:16.345Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-23-1890",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1890/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2023-51585",
    "datePublished": "2024-05-03T02:15:16.345Z",
    "dateReserved": "2023-12-20T20:38:20.869Z",
    "dateUpdated": "2024-08-02T22:40:33.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.\\n\\nThe specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071.\"}, {\"lang\": \"es\", \"value\": \"Voltronic Power ViewPower USBCommEx apagado Inyecci\\u00f3n de comandos Vulnerabilidad de ejecuci\\u00f3n remota de c\\u00f3digo. Esta vulnerabilidad permite a atacantes remotos ejecutar c\\u00f3digo arbitrario en instalaciones afectadas de Voltronic Power ViewPower Pro. Se requiere la interacci\\u00f3n del usuario para aprovechar esta vulnerabilidad, ya que un administrador debe activar una operaci\\u00f3n de apagado. La falla espec\\u00edfica existe dentro del m\\u00e9todo de apagado. El problema se debe a la falta de validaci\\u00f3n adecuada de una cadena proporcionada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\\u00f3digo en el contexto del usuario actual. Era ZDI-CAN-22071.\"}]",
      "id": "CVE-2023-51585",
      "lastModified": "2024-11-21T08:38:26.080",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"zdi-disclosures@trendmicro.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2024-05-03T03:16:18.547",
      "references": "[{\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-23-1890/\", \"source\": \"zdi-disclosures@trendmicro.com\"}, {\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-23-1890/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "zdi-disclosures@trendmicro.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"zdi-disclosures@trendmicro.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-51585\",\"sourceIdentifier\":\"zdi-disclosures@trendmicro.com\",\"published\":\"2024-05-03T03:16:18.547\",\"lastModified\":\"2025-07-09T16:58:50.287\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.\\n\\nThe specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071.\"},{\"lang\":\"es\",\"value\":\"Voltronic Power ViewPower USBCommEx apagado Inyecci\u00f3n de comandos Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de Voltronic Power ViewPower Pro. Se requiere la interacci\u00f3n del usuario para aprovechar esta vulnerabilidad, ya que un administrador debe activar una operaci\u00f3n de apagado. La falla espec\u00edfica existe dentro del m\u00e9todo de apagado. El problema se debe a la falta de validaci\u00f3n adecuada de una cadena proporcionada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del usuario actual. Era ZDI-CAN-22071.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"zdi-disclosures@trendmicro.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"zdi-disclosures@trendmicro.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"2CE4A520-86B5-4AE3-AD0E-7744328090E4\"}]}]}],\"references\":[{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-23-1890/\",\"source\":\"zdi-disclosures@trendmicro.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-23-1890/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-23-1890/\", \"name\": \"ZDI-23-1890\", \"tags\": [\"x_research-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T22:40:33.849Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-51585\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-03T14:31:41.131860Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:power-software-download:viewpower:1.04-21353:*:*:*:-:*:*:*\"], \"vendor\": \"power-software-download\", \"product\": \"viewpower\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.04-21353\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-03T14:32:45.845Z\"}}], \"cna\": {\"title\": \"Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability\", \"source\": {\"lang\": \"en\", \"value\": \"06fe5fd2bc53027c4a3b7e395af0b850e7b8a044\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"Voltronic Power\", \"product\": \"ViewPower\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.04.21353\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2023-12-20T17:09:26.569-06:00\", \"references\": [{\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-23-1890/\", \"name\": \"ZDI-23-1890\", \"tags\": [\"x_research-advisory\"]}], \"dateAssigned\": \"2023-12-20T14:45:49.332-06:00\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.\\n\\nThe specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"99f1926a-a320-47d8-bbb5-42feb611262e\", \"shortName\": \"zdi\", \"dateUpdated\": \"2024-05-03T02:15:16.345Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-51585\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T22:40:33.849Z\", \"dateReserved\": \"2023-12-20T20:38:20.869Z\", \"assignerOrgId\": \"99f1926a-a320-47d8-bbb5-42feb611262e\", \"datePublished\": \"2024-05-03T02:15:16.345Z\", \"assignerShortName\": \"zdi\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-J553-RM7R-HFRP

Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31

Details

The specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071.

Severity ?

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-51585"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:16:18Z",
    "severity": "HIGH"
  },
  "details": "Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.\n\nThe specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071.",
  "id": "GHSA-j553-rm7r-hfrp",
  "modified": "2024-05-03T03:31:07Z",
  "published": "2024-05-03T03:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51585"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1890"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CNVD-2025-21596

Vulnerability from cnvd - Published: 2025-09-18

Title

Voltronic Power ViewPower远程代码执行漏洞（CNVD-2025-2159604）

Description

Voltronic Power ViewPower是Voltronic Power公司的一款适用于太阳能逆变器的监控和管理软件。 Voltronic Power ViewPower存在远程代码执行漏洞，该漏洞源于shutdown方法中存在特定缺陷，攻击者可以利用该漏洞在当前用户的上下文中执行代码。

Severity

高

Patch Name

Voltronic Power ViewPower远程代码执行漏洞（CNVD-2025-2159604）的补丁

Patch Description

Voltronic Power ViewPower是Voltronic Power公司的一款适用于太阳能逆变器的监控和管理软件。 Voltronic Power ViewPower存在远程代码执行漏洞，该漏洞源于shutdown方法中存在特定缺陷，攻击者可以利用该漏洞在当前用户的上下文中执行代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下厂商提供的安全补丁以修复该漏洞： https://voltronicpower.com/en-US/Support/Software/ViewPower-Pro

Reference

https://www.zerodayinitiative.com/advisories/ZDI-23-1890/

Impacted products

Name
Voltronic Power ViewPower 1.04.21353

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-51585",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-51585"
    }
  },
  "description": "Voltronic Power ViewPower\u662fVoltronic Power\u516c\u53f8\u7684\u4e00\u6b3e\u9002\u7528\u4e8e\u592a\u9633\u80fd\u9006\u53d8\u5668\u7684\u76d1\u63a7\u548c\u7ba1\u7406\u8f6f\u4ef6\u3002\n\nVoltronic Power ViewPower\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eshutdown\u65b9\u6cd5\u4e2d\u5b58\u5728\u7279\u5b9a\u7f3a\u9677\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5f53\u524d\u7528\u6237\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttps://voltronicpower.com/en-US/Support/Software/ViewPower-Pro",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-21596",
  "openTime": "2025-09-18",
  "patchDescription": "Voltronic Power ViewPower\u662fVoltronic Power\u516c\u53f8\u7684\u4e00\u6b3e\u9002\u7528\u4e8e\u592a\u9633\u80fd\u9006\u53d8\u5668\u7684\u76d1\u63a7\u548c\u7ba1\u7406\u8f6f\u4ef6\u3002\r\n\r\nVoltronic Power ViewPower\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eshutdown\u65b9\u6cd5\u4e2d\u5b58\u5728\u7279\u5b9a\u7f3a\u9677\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5f53\u524d\u7528\u6237\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Voltronic Power ViewPower\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2025-2159604\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Voltronic Power ViewPower 1.04.21353"
  },
  "referenceLink": "https://www.zerodayinitiative.com/advisories/ZDI-23-1890/",
  "serverity": "\u9ad8",
  "submitTime": "2023-12-25",
  "title": "Voltronic Power ViewPower\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2025-2159604\uff09"
}

FKIE_CVE-2023-51585

Vulnerability from fkie_nvd - Published: 2024-05-03 03:16 - Updated: 2025-07-09 16:58

Severity ?

8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	zdi-disclosures@trendmicro.com	https://www.zerodayinitiative.com/advisories/ZDI-23-1890/	Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://www.zerodayinitiative.com/advisories/ZDI-23-1890/	Third Party Advisory

Impacted products

	Vendor	Product	Version
	voltronicpower	viewpower	1.04.21353

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:voltronicpower:viewpower:1.04.21353:*:*:*:-:*:*:*",
              "matchCriteriaId": "2CE4A520-86B5-4AE3-AD0E-7744328090E4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Voltronic Power ViewPower USBCommEx shutdown Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation.\n\nThe specific flaw exists within the shutdown method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22071."
    },
    {
      "lang": "es",
      "value": "Voltronic Power ViewPower USBCommEx apagado Inyecci\u00f3n de comandos Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de Voltronic Power ViewPower Pro. Se requiere la interacci\u00f3n del usuario para aprovechar esta vulnerabilidad, ya que un administrador debe activar una operaci\u00f3n de apagado. La falla espec\u00edfica existe dentro del m\u00e9todo de apagado. El problema se debe a la falta de validaci\u00f3n adecuada de una cadena proporcionada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del usuario actual. Era ZDI-CAN-22071."
    }
  ],
  "id": "CVE-2023-51585",
  "lastModified": "2025-07-09T16:58:50.287",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-03T03:16:18.547",
  "references": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1890/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1890/"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "zdi-disclosures@trendmicro.com",
      "type": "Secondary"
    }
  ]
}

GSD-2023-51585

Vulnerability from gsd - Updated: 2023-12-21 06:01

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2023-51585

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-51585"
      ],
      "id": "GSD-2023-51585",
      "modified": "2023-12-21T06:01:31.517755Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-51585",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-51585 (GCVE-0-2023-51585)

GHSA-J553-RM7R-HFRP

CNVD-2025-21596

FKIE_CVE-2023-51585

GSD-2023-51585

Tags

Sightings

Nomenclature