CVE-2023-28343: Altenergy Power Control Software OS Command Injection in set_timezone

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, combined with a very high EPSS score and public exploit references, makes this an urgent remote code execution risk.

What it is

Altenergy Power Control Software C1.2.5 passes the timezone parameter of index.php/management/set_timezone into a shell command without sanitization, allowing OS command injection through shell metacharacters. The flaw is in set_timezone in models/management_model.php. With a CVSS base score of 9.8 and no authentication required, it is a severe pre-auth remote code execution risk for exposed instances.

Impact

An unauthenticated attacker can execute arbitrary operating system commands on the host running the control software, leading to full compromise of confidentiality, integrity and availability. This can expose or alter energy management data and provide a foothold for lateral movement.

Attack surface

Reached over the network via HTTP requests to index.php/management/set_timezone with a crafted timezone parameter. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.84752, 99.695th percentile) and public references include an Exploit-tagged third-party advisory and a Packet Storm disclosure, indicating public exploit code is available.

What to do

• Apply the vendor fix for Altenergy Power Control Software if available; check apsystems.com for updates.
• If no patch exists, restrict network access to the management interface using firewall rules or a VPN, and never expose it directly to the internet.
• Validate and sanitize the timezone parameter server-side, rejecting shell metacharacters, and avoid passing user input to shell commands.
• Run the control software with least privilege and in a segmented network to limit the impact of command execution.

Detection

• Monitor HTTP requests to index.php/management/set_timezone for shell metacharacters such as ;, |, &, $, backticks or newlines in the timezone parameter.
• Alert on unexpected child processes spawned by the web server or PHP process, especially shell interpreters.
• Review web server and application logs for anomalous requests to management endpoints from untrusted sources.
• Use file integrity monitoring and process auditing on hosts running the control software to detect post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.