Cyber Resilience

CVE-2023-51595

Critical

Published: 03 May 2024

Published
03 May 2024
Modified
09 July 2025
KEV Added
—
Patch
—
CVSS Score v3 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.3639 97.2th percentile
Risk Priority 41 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-51595 is a critical-severity SQL Injection (CWE-89) vulnerability in Voltronicpower Viewpower. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2023-51595 is a SQL injection vulnerability in Voltronic Power ViewPower Pro that leads to unauthenticated remote code execution. The flaw resides in the selectDeviceListBy method, which fails to validate user-supplied input before using it to build SQL queries, allowing an attacker to execute arbitrary code in the context of the LOCAL SERVICE account. The affected product is Voltronic Power ViewPower Pro, and the issue carries a CVSS 3.0 score of 9.8.

Remote attackers can exploit the vulnerability over the network without authentication or user interaction to achieve full code execution on the target system. The weakness is tracked as CWE-89 and was originally reported as ZDI-CAN-22163.

The current and peak EPSS score for the CVE stands at 0.3639 with no material rise from a lower baseline after disclosure.

EU & UK References

Vulnerability details

Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The specific flaw exists…

more

within the selectDeviceListBy method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22163.

CWE(s)
CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

voltronicpower
viewpower
2.0-22165

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References