9.8
CRITICAL
CVE-2023-28343
Altenergy Power Control Software OS Command Injection
Description

OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.

INFO

Published Date :

March 14, 2023, 8:15 p.m.

Last Modified :

Nov. 21, 2024, 7:54 a.m.

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2023-28343 has a 5 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2023-28343 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Apsystems energy_communication_unit_firmware
2 Apsystems energy_communication_unit

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

CVE-2023-28343

Python

Updated: 3 months, 2 weeks ago
1 stars 0 fork 0 watcher
Born at : July 3, 2023, 11:48 a.m. This repo has been linked 1 different CVEs too.

CVE-2023-28343 POC exploit

Python

Updated: 3 months, 2 weeks ago
8 stars 5 fork 5 watcher
Born at : March 23, 2023, 3:19 p.m. This repo has been linked 1 different CVEs too.

Altenergy Power System Control Software set_timezone RCE Vulnerability (CVE-2023-28343)

Updated: 1 year, 5 months ago
6 stars 0 fork 0 watcher
Born at : March 21, 2023, 11:41 a.m. This repo has been linked 1 different CVEs too.

本软件首先集成危害性较大框架和部分主流cms的rce(无需登录,或者登录绕过执行rce)和反序列化(利用链简单)。傻瓜式导入url即可实现批量getshell。批量自动化测试。例如:Thinkphp,Struts2,weblogic。出现的最新漏洞进行实时跟踪并且更新例如:log4jRCE,向日葵 禅道RCE 瑞友天翼应用虚拟化系统sql注入导致RCE大华智慧园区上传,金蝶云星空漏洞等等.

cve-2022-1388 cve-2022-22947 cve-2022-22954 cve-2022-22963 cve-2022-22965 cve-2022-23131 cve-2022-29464 cve-2022-30525 qvd-2023-6271 cve-2023-28432 qvd-2023-8621 cve-2023-34960 cve-2023-27372 cve-2024-25600 qvd-2024-11354 cve-2024-5084 cve-2024-36401 qvd-2024-44346 cve-2024-9047 cve-2025-3248

C++ C#

Updated: 1 month ago
261 stars 11 fork 11 watcher
Born at : Jan. 8, 2023, 5:21 a.m. This repo has been linked 43 different CVEs too.

POC exploit index

Updated: 3 years ago
0 stars 0 fork 0 watcher
Born at : May 19, 2022, 6:09 a.m. This repo has been linked 8 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-28343 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2023-28343 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/171775/Altenergy-Power-Control-Software-C1.2.5-Command-Injection.html
    Added Reference https://apsystems.com
    Added Reference https://github.com/ahmedalroky/Disclosures/blob/main/apesystems/os_command_injection.md
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Apr. 10, 2023

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/171775/Altenergy-Power-Control-Software-C1.2.5-Command-Injection.html [No Types Assigned]
  • Initial Analysis by [email protected]

    Mar. 21, 2023

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://apsystems.com No Types Assigned https://apsystems.com Product
    Changed Reference Type https://github.com/ahmedalroky/Disclosures/blob/main/apesystems/os_command_injection.md No Types Assigned https://github.com/ahmedalroky/Disclosures/blob/main/apesystems/os_command_injection.md Exploit, Third Party Advisory
    Added CWE NIST CWE-78
    Added CPE Configuration AND OR *cpe:2.3:o:apsystems:energy_communication_unit_firmware:c1.2.5:*:*:*:*:*:*:* OR cpe:2.3:h:apsystems:energy_communication_unit:-:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-28343 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

93.79 }} 2.38%

score

0.99845

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
© cvefeed.io
Latest DB Update: Jun. 03, 2025 17:23