CVE-2023-28343

Altenergy Power Control Software (the APsystems Energy Communication Unit) has an OS command injection: shell metacharacters in the timezone parameter of index.php/management/set_timezone flow through set_timezone in the management model into a shell. Unauthenticated and remote, a crafted request yields command execution on the device, full control of an energy communication unit with no login required.

This sits at the IT/OT boundary in solar energy deployments, and unauthenticated command injection on internet-reachable energy gear is exactly what opportunistic botnets and, increasingly, actors interested in disrupting distributed energy resources go looking for. Proof-of-concept traffic for a clean, unauthenticated one-request injection like this tends to appear fast and hit every reachable unit indiscriminately. The 9.8 is fully earned.

Our controlling factor is internet reachability. We would hunt for any APsystems ECU exposed to untrusted networks, pull the management interface off the public internet, and segment these units away from both IT and the wider internet. Since the payload is a specific parameter on a specific path, a virtual-patch rule blocking metacharacters into set_timezone is a viable stopgap while firmware remediation is worked out on OT timelines.