TI-2023-12944 Aliases CVE-2023-28398 GHSA-xxmg-8g8r-g92f

Improper authentication in ProPump and Controls, Inc. Osprey Pump Controller

MEDIUM 51CWE-287Published 2023-03-28 · Updated 2025-01-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat actor could exploit this vulnerability to create a user account without providing valid credentials. A threat actor who successfully exploits this vulnerability could gain access to the pump controller and cause disruption in operation, modify data, or shut down the controller.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00892 59th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ProPump and Controls, Inc.	Osprey Pump Controller	1.01	—	No fix listed	CNA

Osprey Pump Controller VendorProPump and Controls, Inc. Affected 1.01 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:::::::*	1.01	Vulnerable	ProPump and Controls, Inc.
cpe:2.3:h:propumpservice:osprey_pump_controller:-:::::::*	not specified by NVD	Running on	ProPump and Controls, Inc.

cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·ProPump and Controls, Inc.
cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ProPump and Controls, Inc.

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-28398
2026-10-03 Alias added: GHSA-xxmg-8g8r-g92f

References

Advisory 1

https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06

TI-2023-12126 OS command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
TI-2023-12477 OS command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
TI-2023-13229 Command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
TI-2023-13172 Hard-coded credentials in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
TI-2023-12921 Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure. CVSS 3.1HIGH 7.5
TI-2023-13166 Cross-site scripting in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences