Cyber Resilience

CVE-2023-51593

CriticalRCE

Published: 03 May 2024

Published
03 May 2024
Modified
09 July 2025
KEV Added
—
Patch
—
CVSS Score v3 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0272 86.2th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-51593 is a critical-severity Expression Language Injection (CWE-917) vulnerability in Voltronicpower Viewpower. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 13.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Voltronic Power ViewPower Pro Expression Language Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The specific flaw exists…

more

within the Struts2 dependency. The issue results from the use of a library that is vulnerable to expression language injection. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22095.

CWE(s)
CWE-917

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

voltronicpower
viewpower
2.0-22165

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References