Cross-site request forgery in ProPump and Controls, Inc. Osprey Pump Controller
Priority LOW 36CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Osprey Pump Controller version 1.01 allows users to perform certain actions via HTTP requests without performing any checks to verify the requests. This may allow an attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ProPump and Controls, Inc. | Osprey Pump Controller | 1.01 | — | No fix listed | CNA |
- Osprey Pump Controller VendorProPump and Controls, Inc. Affected 1.01 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* | 1.01 | Vulnerable | ProPump and Controls, Inc. |
| cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ProPump and Controls, Inc. |
- cpe:2.3:o:propumpservice:osprey_pump_controller_firmware:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·ProPump and Controls, Inc.
- cpe:2.3:h:propumpservice:osprey_pump_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ProPump and Controls, Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28718
- 2026-10-03 Alias added: GHSA-h56j-23jq-w46f
References
More ProPump and Controls, Inc. Osprey Pump Controller Firmware vulnerabilities
- TI-2023-12126 OS command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-12477 OS command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-12944 Improper authentication in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-13229 Command injection in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-13172 Hard-coded credentials in ProPump and Controls, Inc. Osprey Pump Controller CVSS 3.1CRITICAL 9.8
- TI-2023-12921 Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated file disclosure. CVSS 3.1HIGH 7.5
Sources
- CVE-2023-28718 · CVE Program
- CVE-2023-28718 · NVD
- FIRST EPSS
- GHSA-h56j-23jq-w46f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences