CVE-2023-28395 - CVE House
Back to Database
Status published High CVE-2023-28395

CVE-2023-28395

Vulnerability Description

Osprey Pump Controller version 1.01 is vulnerable to a weak session token generation algorithm that can be predicted and can aid in authentication and authorization bypass. This may allow an attacker to hijack a session by predicting the session id and gain unauthorized access to the product.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28395

Credits & Attribution

No credits recorded in the NVD database.

References

More from ProPump and Controls, Inc.

View All →
CVE-2023-28718
CVE-2023-28718
High 7.1
CVE-2023-28712
CVE-2023-28712
High 8.2
CVE-2023-28654
CVE-2023-28654
Critical 9.8
CVE-2023-28648
CVE-2023-28648
High 7.5
CVE-2023-28398
CVE-2023-28398
Critical 9.8

Affected Vendor

ProPump and Controls, Inc.

View all reports →

Affected Software

Osprey Pump Controller
Vulnerable Versions:
1.01

Timeline

Official Publish: March 28th, 2023
Last Modified: January 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.