Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and the password cannot be changed through any normal operation of the device.
References
Link | Resource |
---|---|
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
AND |
|
History
05 Apr 2023, 13:09
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
CWE | CWE-798 | |
References | (MISC) https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 - Third Party Advisory, US Government Resource | |
First Time |
Propumpservice osprey Pump Controller
Propumpservice osprey Pump Controller Firmware Propumpservice |
28 Mar 2023, 21:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-03-28 21:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-28654
Mitre link : CVE-2023-28654
CVE.ORG link : CVE-2023-28654
JSON object : View
Products Affected
propumpservice
- osprey_pump_controller_firmware
- osprey_pump_controller
CWE
CWE-798
Use of Hard-coded Credentials