Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and the password cannot be changed through any normal operation of the device.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 | Third Party Advisory US Government Resource |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 - Third Party Advisory, US Government Resource |
05 Apr 2023, 13:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06 - Third Party Advisory, US Government Resource | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Propumpservice osprey Pump Controller Firmware
Propumpservice Propumpservice osprey Pump Controller |
|
| CWE | CWE-798 | |
| CPE | cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* |
28 Mar 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-28 21:15
Updated : 2024-11-21 07:55
NVD link : CVE-2023-28654
Mitre link : CVE-2023-28654
CVE.ORG link : CVE-2023-28654
JSON object : View
Products Affected
propumpservice
- osprey_pump_controller_firmware
- osprey_pump_controller
CWE
CWE-798
Use of Hard-coded Credentials