Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability

The impact of CVE-2023-51595 is severe due to its ease of exploitation and potential for complete system takeover. An attacker can directly inject malicious SQL code through the selectDeviceListBy endpoint, bypassing authentication. Successful exploitation allows the attacker to execute commands on the system with LOCAL SERVICE privileges. This could lead to data exfiltration, modification of system configurations, installation of malware, and ultimately, full control of the affected ViewPower Pro device. Given the lack of authentication required, the vulnerability presents a significant risk to any system running an affected version of ViewPower Pro.

Organizations utilizing Voltronic Power ViewPower Pro for industrial control or monitoring systems are at significant risk. Specifically, deployments with direct internet exposure or lacking robust network segmentation are particularly vulnerable. Shared hosting environments where multiple users share the same ViewPower Pro instance also increase the potential attack surface.

• linux / server: Monitor access logs for unusual SQL queries targeting the selectDeviceListBy endpoint. Use journalctl to filter for errors related to SQL execution.

journalctl -u viewpower_pro -f | grep "SQL injection"

• generic web: Use curl to test the selectDeviceListBy endpoint with a simple SQL injection payload (e.g., ' OR '1'='1). Check the response for unexpected behavior or error messages.

curl 'http://<viewpower_pro_ip>/selectDeviceListBy?param='; OR '1'='1'

1. 2024-05-03Disclosure

   disclosure

1. 已保留2023-12-20
2. 发布日期2024-05-03
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2023-51595 is to upgrade ViewPower Pro to a patched version. Voltronic Power has released a fix; consult their advisory for details. As a temporary workaround, implement Web Application Firewall (WAF) rules to filter potentially malicious SQL injection attempts targeting the selectDeviceListBy endpoint. Input validation on the server-side, specifically sanitizing user-supplied data before constructing SQL queries, can also reduce the attack surface. Consider implementing strict access controls and network segmentation to limit the potential blast radius if the vulnerability is exploited. After upgrade, confirm by attempting to trigger the selectDeviceListBy endpoint with a known malicious SQL injection payload; it should now be properly sanitized and not execute arbitrary code.