CVE-2023-3260

HIGH

Cyberpower Powerpanel Server < 2.6.9 - OS Command Injection

Title source: rule

Description

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.

References (1)

Core 1

Core References

Vendor Advisory

https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html

Scores

CVSS v3 7.2

EPSS 0.0119

EPSS Percentile 64.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (23)

cyberpower/powerpanel_server < 2.6.9

dataprobe/iboot-pdu4-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4-n20_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-c10_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-n15_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-n20_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-c10_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-n15_firmware < 1.44.0804202

... and 13 more

Published Aug 14, 2023

Tracked Since Feb 18, 2026