CVE-2022-31491# CVE-2022-31491
Metasploit module and PoC are coming.
[Further Information](https://www.ready2disclose.com/vpow-31491-43110/)
## Voltronic Viewpower/Pro and rebrands/derivatives
The UPS management software normally allows a properly Authenticated and Authorized user using a web interface to configure the system to run a single OS command of the users choosing when the software detects a managed UPS is shutting down. For example stop a batch job or send an alert to another system via a single command.
Due to a related critical underlying function being exposed over the network (CWE-749: Exposed Unsafe Active Functionality) with no Authentication or Authorization an attacker can use this to run arbitrary code immediately regardless of any managed UPS state or presence.
登录后查看神龙缓存的 POC 文件快照
登录查看