Powertek PDU Firmware security bypass | CVE-2022-33175
NAME
Powertek PDU Firmware security bypass
- Platforms Affected:
Powertek PDU firmware 3.30.17 - Risk Level:
9.8 - Exploitability:
Unproven - Consequences:
Bypass Security
DESCRIPTION
Powertek PDU Firmware could allow a remote attacker to bypass security restrictions, caused by an insecure permissions setting on the user.token field. By sending a specially-crafted request using the /cgi/get_param.cgi HTTP API, an attacker could exploit this vulnerability to act as the administrator to obtain of the cleartext password, or reconfigure the device.
CVSS 3.0 Information
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Access Vector: Network
- Access Complexity: Low
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Remediation Level: Official Fix
MITIGATION
Upgrade to the latest version of Powertek firmware (3.30.30 or later), available from the Powertek Web site. See References.
- Reference Link:
https://gynvael.coldwind.pl/?lang=en&id=748 - Reference Link:
https://www.powertekpdus.com/
If you like the site, please consider joining the telegram channel and supporting us on Patreon using the button below.
