CVE-2023-51573: Voltronic Power ViewPower Pro updateManagerPassword auth bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityUnauthenticated remote authentication bypass with CVSS 9.8 and very high EPSS, though no KEV listing or confirmed exploitation is documented.

What it is

ViewPower Pro exposes a dangerous function, updateManagerPassword, that lets a remote attacker bypass authentication. Because the flaw is reachable without credentials and the CVSS vector shows no user interaction, any network-reachable instance is at risk. The record does not list affected version ranges, so defenders must confirm exposure against their own deployment.

Impact

An attacker gains full unauthenticated access to the system, with high confidentiality, integrity and availability impact per the CVSS vector. In practice this means control over the management interface and the data and power-management functions it governs.

Attack surface

Reached over the network via the exposed updateManagerPassword function; the CVSS vector is AV:N/PR:N/UI:N, so no authentication and no user interaction are required. The description does not specify the exact port or endpoint, so the reachable service must be identified from the deployment.

Exploitation

Not listed in CISA KEV and no public exploit reference is given beyond the ZDI advisory, but EPSS is 0.457 (98.7th percentile), indicating elevated likelihood of exploitation activity. Treat as high-risk despite the absence of confirmed in-the-wild reporting.

What to do

• Apply the vendor fix for ViewPower Pro as soon as Voltronic Power publishes it; the record does not name a patched version, so confirm with the vendor.
• Until patched, remove ViewPower Pro management interfaces from untrusted networks and restrict access to a management VLAN or VPN.
• Block or filter external access to the service port and monitor for unexpected inbound connections to it.
• Audit and rotate any credentials or configuration reachable through the management interface, since authentication can be bypassed.
• If the product cannot be isolated or patched, consider taking the affected instance offline.

Detection

• Monitor for unauthenticated or anomalous requests to the updateManagerPassword function or related management endpoints.
• Alert on successful management logins or configuration changes from unexpected source IPs or at unusual times.
• Baseline normal ViewPower Pro network traffic and flag new external connections to its service ports.
• Review application and system logs for authentication bypass indicators or unexpected administrative actions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.