Hard-coded credentials in ProPump and Controls, Inc. Osprey Pump Controller
Priority MEDIUM 50CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and the password cannot be changed through any normal operation of the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00771 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ProPump and Controls, Inc. | Osprey Pump Controller | 1.01 | — | No fix listed | CNA |
- Osprey Pump Controller VendorProPump and Controls, Inc. Affected 1.01 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* | 1.01 | Vulnerable | ProPump and Controls, Inc. |
| cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ProPump and Controls, Inc. |
- cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·ProPump and Controls, Inc.
- cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ProPump and Controls, Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28654
- 2026-10-03 Alias added: GHSA-6v85-xmc7-gr5h
References
More ProPump and Controls, Inc. Osprey Pump Controller Firmware vulnerabilities
- TI-2023-12126 OS command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-12477 OS command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-12944 Improper authentication in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-13229 Command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-12921 Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure. CVSS 3.1HIGH 7.5
- TI-2023-13166 Cross-site scripting in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1HIGH 7.5
Sources
- CVE-2023-28654 · CVE Program
- CVE-2023-28654 · NVD
- FIRST EPSS
- GHSA-6v85-xmc7-gr5h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences