Critical severity · published Mar 28, 2023
CVE-2023-27886
Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP POST parameter called by index.php script.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Osprey Pump Controller Firmware · Propumpservice
1.01 · source: NVD
Affected product
OP
Osprey Pump Controller Firmware
Propumpservice
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27886
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27886
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
More from Osprey Pump Controller Firmware
9.8
CVE-2023-28712
Osprey Pump Controller version 1.01 contains an unauthenticated command injection vulnerability that could allow system access with www-data permissions
9.8
CVE-2023-28654
Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration
9.8
CVE-2023-28398
Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system
9.8
CVE-2023-27394
Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability
8.0
CVE-2023-28718
Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests