CVE-2023-51595: SQL Injection in ViewPower Pro

The impact of CVE-2023-51595 is severe due to its ease of exploitation and potential for complete system takeover. An attacker can directly inject malicious SQL code through the selectDeviceListBy endpoint, bypassing authentication. Successful exploitation allows the attacker to execute commands on the system with LOCAL SERVICE privileges. This could lead to data exfiltration, modification of system configurations, installation of malware, and ultimately, full control of the affected ViewPower Pro device. Given the lack of authentication required, the vulnerability presents a significant risk to any system running an affected version of ViewPower Pro.

1. Reserved2023-12-20
2. Published2024-05-03
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-51595 is to upgrade ViewPower Pro to a patched version. Voltronic Power has released a fix; consult their advisory for details. As a temporary workaround, implement Web Application Firewall (WAF) rules to filter potentially malicious SQL injection attempts targeting the selectDeviceListBy endpoint. Input validation on the server-side, specifically sanitizing user-supplied data before constructing SQL queries, can also reduce the attack surface. Consider implementing strict access controls and network segmentation to limit the potential blast radius if the vulnerability is exploited. After upgrade, confirm by attempting to trigger the selectDeviceListBy endpoint with a known malicious SQL injection payload; it should now be properly sanitized and not execute arbitrary code.