60
CVE-2023-3259
—1CVSS 3.1
9.8 critical
EPSS
<1%p59
Published
()
Modified
Description
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information
- Vendors
- dataprobe
- Products
- iboot-pdu4a-c10 firmware, iboot-pdu4a-c20 firmware, iboot-pdu4a-n15 firmware, iboot-pdu4a-n20 firmware, iboot-pdu4-c20 firmware, iboot-pdu4-n20 firmware, iboot-pdu4sa-c10 firmware, iboot-pdu4sa-c20 firmware, iboot-pdu4sa-n15 firmware, iboot-pdu4sa-n20 firmware, iboot-pdu8a-2c10 firmware, iboot-pdu8a-2c20 firmware
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news4 stories
Several Flaws Found in CyberPower and Dataprobe Products
60
Flaws in CyberPower solutions expose data centers to hacking
60
47