ProPump and Controls Osprey Pump Controller (Update A)

🗓️ 23 Mar 2023 06:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 60 Views

Osprey Pump Controller Vulnerabilities including insufficient entropy, use of hard-coded password, and command injection

Reporter	Title	Published	Views	Family All 108
BDU FSTEC	The vulnerability of the microprogramming software of Osprey Pump Controller allows a hacker to gain full access to the device’s web interface.	27 Nov 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Osprey Pump Controller controllers, due to the lack of measures taken to protect the website structure, allows a hacker to execute arbitrary code.	6 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the microprogramming software of Osprey Pump Controller allows a intruder to execute arbitrary commands.	6 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Osprey Pump Controller controllers allows a intruder to gain unauthorized access to the device.	8 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Osprey Pump Controller controllers allows a intruder to alter arbitrary data or cause malfunctions during maintenance.	8 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the DataLogView.php, EventsView.php, and AlarmsView.php scripts of the microprogramming software for Osprey Pump Controller controllers allows a perpetrator to execute arbitrary commands.	8 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Osprey Pump Controller controllers allows a intruder to gain unauthorized access to the device.	8 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Osprey Pump Controller controllers, related to the disclosure of information through a query line, allows an intruder to disclose protected information.	20 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the microprogramming software of Osprey Pump Controller allows a intruder to execute arbitrary commands.	20 Feb 202400:00	–	bdu_fstec
Circl	CVE-2023-27394	29 Mar 202300:46	–	circl

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-082-06.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/uscert/ics/recommended-practices
cisa	www.cisa.gov/ics
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

23 Mar 2023 06:00Current

10High risk

Vulners AI Score10

CVSS 3.19.8

EPSS0.10872

SSVC

osprey pump controller vulnerabilities insufficient entropy hard-coded password command injection cvss v3 9.8 exploitable remotely low attack complexity csrf authentication bypass cross-site scripting