Cyber Resilience

CVE-2023-28343

CriticalPublic PoCRCE

Published: 14 March 2023

Published
14 March 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9379 99.9th percentile
Risk Priority 76 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-28343 is a critical-severity OS Command Injection (CWE-78) vulnerability in Apsystems Energy Communication Unit Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2023-28343 is an OS command injection vulnerability affecting Altenergy Power Control Software version C1.2.5. The flaw resides in the set_timezone function in models/management_model.php, which fails to sanitize shell metacharacters supplied in the timezone parameter to the index.php/management/set_timezone endpoint.

An unauthenticated remote attacker can exploit the issue over the network by submitting a crafted HTTP request containing malicious metacharacters. Successful exploitation grants arbitrary operating-system command execution with full impact on confidentiality, integrity, and availability, consistent with the CVSS 9.8 rating and CWE-78 classification.

Public proof-of-concept code demonstrating the injection has been published on Packet Storm and GitHub. The associated EPSS score has reached a peak of 0.9663 and currently stands at 0.9379, indicating sustained exploitation interest following disclosure.

EU & UK References

Vulnerability details

OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apsystems
energy communication unit firmware
c1.2.5

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References