CVE-2022-31491

CriticalRCE

Published: 22 August 2025

Published

22 August 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0017 38.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-31491 is a critical-severity Code Injection (CWE-94) vulnerability in Cisa (inferred from references). Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2022-31491 is a critical remote code execution vulnerability (CWE-94: Improper Control of Generation of Code, CWE-749: Exposed Dangerous Method or Function) affecting Voltronic Power's ViewPower software through version 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292. The flaw exists in an unspecified web interface related to detection of a managed uninterruptible power supply (UPS) shutting down, enabling attackers to execute arbitrary code.

An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no user interaction required, achieving full confidentiality, integrity, and availability impacts with a scope change, as scored at CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation allows immediate arbitrary code execution regardless of any managed UPS state or presence.

For mitigation details, refer to the CISA ICS Advisory ICSA-25-182-05 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-05 and the vendor disclosure at https://www.ready2disclose.com/vpow-31491-43110/.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2022-54224

Vulnerability details

Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interface related to detection of a managed UPS shutting down. An unauthenticated attacker can…

use this to run arbitrary code immediately regardless of any managed UPS state or presence.

CWE(s): CWE-94 CWE-749

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct unauthenticated RCE in exposed web interface of public-facing UPS management software (CWE-94), enabling initial access via exploitation of internet-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1