CVE-2023-3263

HIGH

Dataprobe iBoot PDU Firmware < 1.44.0804202 - Authentication Bypass via REST API Credential Parsing

Title source: llm

Description

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution.

References (1)

Core 1

Core References

Vendor Advisory

https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html

Scores

CVSS v3 7.5

EPSS 0.0064

EPSS Percentile 45.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-287 CWE-289

Status published

Products (22)

dataprobe/iboot-pdu4-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4-n20_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-c10_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-n15_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-n20_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-c10_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-n15_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-n20_firmware < 1.44.0804202

... and 12 more

Published Aug 14, 2023

Tracked Since Feb 18, 2026