CVE-2023-51583

The vulnerability exists in the UpsScheduler class, where a dangerous method has been exposed remotely without proper security controls (CWE-749: Exposed Dangerous Method or Function). An attacker can invoke this method from outside the network without providing any authentication credentials. The result of invoking the method is code execution in the context of the SYSTEM account, which represents the highest privilege level in the Windows operating system.

An attacker can execute arbitrary code with SYSTEM privileges, gaining full control over the compromised host, including the ability to install malware, steal data, and perform lateral movement within the network.

Apply patches available from the vendor according to the references provided. It is also recommended to restrict network access to the ViewPower service using a firewall to trusted hosts only and monitor network activity related to this service.

Voltronic Power ViewPower — versions indicated in the vendor's references (vulnerability confirmed in ZDI-CAN-22036 identifier)