CVE-2023-28343
Published: 14 March 2023
Summary
CVE-2023-28343 is a critical-severity OS Command Injection (CWE-78) vulnerability in Apsystems Energy Communication Unit Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-28343 is an OS command injection vulnerability affecting Altenergy Power Control Software version C1.2.5. The flaw resides in the set_timezone function in models/management_model.php, which fails to sanitize shell metacharacters supplied in the timezone parameter to the index.php/management/set_timezone endpoint.
An unauthenticated remote attacker can exploit the issue over the network by submitting a crafted HTTP request containing malicious metacharacters. Successful exploitation grants arbitrary operating-system command execution with full impact on confidentiality, integrity, and availability, consistent with the CVSS 9.8 rating and CWE-78 classification.
Public proof-of-concept code demonstrating the injection has been published on Packet Storm and GitHub. The associated EPSS score has reached a peak of 0.9663 and currently stands at 0.9379, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32041
Vulnerability details
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.