SB2025070337 - Multiple vulnerabilities in Voltronic Power ViewPower and Pro

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Exposed dangerous method or function (CVE-ID: CVE-2022-31491)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the exposure of a dangerous function. A remote attacker can execute arbitrary code on the system.

2) Direct Request ('Forced Browsing') (CVE-ID: CVE-2021-43110)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to forced browsing issue within the UPS management software. A remote attacker can make unathorized changes to the system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-05
• https://github.com/PuneethReddyHC/online-shopping-system/issues/17