The Voltronic Editions/Versions

As mentioned, the Voltronics main website itself has 2 main editions, ViewPower and ViewPowerPro (again, in general when we mention ViewPower we mean both/either). Interestingly the versions listed on the website are actually different to what you get in the installer. We have no idea about the version control processes at Voltronic, so sorry if this adds to your confusion.

As at 17th June 2025, the table below hopefully paints this picture a little better using the Windows versions available as an example. Click version links for image of website or add/remove. Take care even when downloading for other Operating Systems that you get what you expect.

Other places we've found it hosted

Apart from the Voltronic main website, there appear to be different (and newer) versions again of ViewPower/Pro hosted on different sites, some of them are resellers of the UPS hardware and thus also host the ViewPower/Pro software. One example is www.power-software-download.com They appear to be signed as expected. This again raises questions around version control, of which we don't know the answers, but its important you're aware of it regardless.

As at 17th June 2025, the table below hopefully paints this picture a little better using the Windows versions from www.power-software-download.com as an example. They're clearly newer versions for at lease one of these than on the main Voltronic Website. This list is not exhaustive and may not be updated. It is however an example of why you need to be careful around the version you have installed/downloaded.

As at 27th Aug 2025, we found an attempted fix published at www.power-software-download.com. They now have some version mismatching going on between what the website announced and the actual version that installs. The attempted fix implemented in verion 1.04.25210 is easily circumvented. This fix on its own just changes the way the payload needs to be formatted. Its still a full RCE. There is also no announcement on the website about this attempted fix, any mention of the CVE or even a simple advisory.

Known rebranded/variants

As at 17th June 2025, represents some known variants. There are more, so this list is not exhaustive, and probably won't be updated.

CVE-2022-43110

The UPS management software is supposed to only allow a properly Authenticated and Authorized admin user using a web interface to configure the system.

Due to CWE-425: Direct Request ('Forced Browsing') an unauthorised, unauthenticated remote attacker can make changes to the system including: changing the web interface admin password, view/change system configuration, enumerate connected UPS devices and shut down connected UPS devices. This extends to being able to configure operating system commands that should run if the system detects a connected UPS shutting down.

CVE-2022-31491

The UPS management software normally allows a properly Authenticated and Authorized user using a web interface to configure the system to run a single OS command of the users choosing when the software detects a managed UPS is shutting down. For example stop a batch job or send an alert to another system via a single command.

Due to a related critical underlying function being exposed over the network CWE-749: Exposed Unsafe Active Functionality with no Authentication or Authorization an attacker can use this to run arbitrary code immediately regardless of any managed UPS state or presence.

Q: How can I tell if I have this software ?

If you have Voltronic Viewpower or a rebranded product, its interface will likley look similar to one of the image below. It is quite a unique looking java app. The main "ViewPower" bold title may be different and match the rebranding company name your software came from.

ViewPowerPro appears a bit different to ViewPower.

Another quick/dirty way to check is to look across your system for a group of Java classes that ViewPower and the known rebranded products have in their .JAR files. This is a powershell script to do exactly that on Windows (searches on C\: so modify/rerun as required). If you have a Linux/Mac system you can use the information in script to fashion your own script to search across JAR files on your system. Note:

• Run this as Administrator or similar to ensure it has access to see .jar files. Modify the $searchPath property and rerun to catch all your drives.
• If these classes are found it it highly likely that you have ViewPower or a possible variant. It does NOT detect the presence of the vulns. Confirm that your installation is patched. Check with your vendor.
• This script does not detect the vulns themselves, or if your installation is patched, it merely indicates the likely precence of ViewPower or a variant on your system.
• This script takes into account a spelling difference we noticed across ViewPower and variants. Processer vs Processor on one of the classes.

Write-Output "Version 1.6"

# Search a windows systems for a few Java classes that appear to be unique/indicative of ViewPower or rebranded product installed on Windows.
# These are 3 random classes that appear to be consistent across the Viewpower original and currently known variant/rebranded products at the time of writing.
# Java classes may also be found on Linux an Mac variants.  No script supplied for those OS, give this to one of your IT gurus for them to create one from.

# Note:
# Run this as Administrator or similar to ensure it has access to see .jar files.   Modify the $searchPath property and rerun to catch all your drives.
# If these classes are found it it highly likely that you have ViewPower or a possible variant.  It does NOT detect the presence of the vulns. Confirm that your installation is patched.  Check with your vendor.
#️ This script does not detect the vulns themselves, or if your installation is patched, it merely indicates the likely precence of ViewPower or a variant on your system.
# This script takes into account a spelling difference we noticed across ViewPower and variants.  Processer vs Processor on one of the classes.


Add-Type -AssemblyName System.IO.Compression.FileSystem

$searchPath = "c:\"    # Modify this and re-run if server/device has other drives
$totalMatches = 0



Get-ChildItem -Path  $searchPath -Recurse -Filter *.jar -ErrorAction SilentlyContinue | ForEach-Object {

        $jarPath = $_.FullName

        $zip = [IO.Compression.ZipFile]::OpenRead($jarPath)

        foreach ($entry in $zip.Entries) {
            if ($entry -like 'cn/com/voltronicpower/monitor/AbstractMonitorProcesser.class' -or 
                $entry -like 'cn/com/voltronicpower/monitor/AbstractMonitorProcessor.class' -or 
                $entry -like 'cn/com/voltronic/console/DisplayItems.class' -or
                $entry -like 'cn/com/voltronicpower/tomcat/Cmd.class'){
                Write-Output "$jarPath    $entry"
                $totalMatches++
                }
        }

        $zip.Dispose()

}

Write-Output "Total matches $totalMatches"
Write-Output "This script looks for the software.  It does NOT check if the vulns are present or not.  It does NOT check if you are patched."

This is the output on a Windows 10 system with Voltronic Viewpower installed.

Q: What should I do if I have this ?

If you have this in your environment and you can't confirm its fixed/patched, consider the following options (in no particular order). On our equipment we took the first option.

• 🗑️ Uninstall it or disconnect the machine from the network. (Hint: take this option)
• 🔥 Ensure your firewalls are not allowing inbound traffic from untrusted networks.
• 🛠️ Check for a patched version/release.
• 🧑‍💼 Contacting the vendor/supplier.

If you find the software, and you believe you're patched... double check. Given we could not confirm version control is going on, you need to be VERY sure.