CVE-2023-28718

8.0 highEPSS 0.3%

High (8.0) in propumpservice osprey pump controller firmware. EPSS 0.3% chance of exploitation in the next 30 days.

Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.

Severity

CVSS 3.1

8.0 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2023-03-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

propumpservice:osprey_pump_controller_firmware

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06

Check your stack JSON