60
CVE-2023-3264
—CVSS 3.1
9.8 critical
EPSS
<1%p39
Published
()
Modified
Description
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.
- Vendors
- cyberpowerdataprobe
- Products
- powerpanel server, iboot-pdu4a-c10 firmware, iboot-pdu4a-c20 firmware, iboot-pdu4a-n15 firmware, iboot-pdu4a-n20 firmware, iboot-pdu4-c20 firmware, iboot-pdu4-n20 firmware, iboot-pdu4sa-c10 firmware, iboot-pdu4sa-c20 firmware, iboot-pdu4sa-n15 firmware, iboot-pdu4sa-n20 firmware, iboot-pdu8a-2c10 firmware
- Weakness
- CWE-798
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news4 stories
Several Flaws Found in CyberPower and Dataprobe Products
60
Flaws in CyberPower solutions expose data centers to hacking
60
47