CVE-2023-51595: Voltronic Power ViewPower Pro SQL Injection Enables Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and remote code execution impact, combined with a high EPSS score, makes this an urgent patching priority despite no KEV listing.

What it is

ViewPower Pro fails to validate user-supplied input in the selectDeviceListBy method before building SQL queries, allowing SQL injection. Because the injected query can be leveraged to run code, an unauthenticated remote attacker can execute arbitrary code on the affected installation. The flaw is rated critical (CVSS 9.8) and affects Voltronic Power ViewPower Pro.

Impact

An attacker gains remote code execution in the context of the LOCAL SERVICE account, which can lead to full compromise of the host and any data or services it manages. No credentials are needed, so exposure is limited only by network reachability of the service.

Attack surface

The vulnerability is reachable over the network via the selectDeviceListBy method, per the CVSS vector AV:N/PR:N/UI:N. No authentication and no user interaction are required, so any host that can reach the affected service can attempt exploitation.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use; EPSS gives a 30-day exploitation probability of about 0.48 (98.8th percentile), indicating high predicted activity. The only references are ZDI advisories, so no public exploit code is confirmed by this record.

What to do

• Apply the vendor patch or fixed ViewPower Pro release as soon as it is available; treat this as the primary action.
• If no patch is available, remove the affected service from untrusted networks and restrict access to a management VLAN or allowlist.
• Place the service behind a reverse proxy or firewall rule that blocks untrusted source IPs from reaching the vulnerable endpoint.
• Run the service under a least-privilege account rather than LOCAL SERVICE to limit post-exploitation impact.
• Monitor vendor and ZDI advisories for updated fixed versions and interim guidance.

Detection

• Review web or application logs for requests to the selectDeviceListBy method containing SQL metacharacters such as quotes, UNION, or stacked queries.
• Alert on unexpected child processes or command shells spawned by the ViewPower Pro service account.
• Monitor for outbound connections from the ViewPower Pro host to unfamiliar IPs, which may indicate post-exploitation activity.
• Baseline normal database query patterns for the service and alert on anomalous or malformed queries.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.