CVE-2023-3264

MEDIUM

Cyberpower Powerpanel Server < 2.6.9 - Hard-coded Credentials

Title source: rule

Description

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.

References (1)

Core 1

Core References

Vendor Advisory

https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html

Scores

CVSS v3 6.7

EPSS 0.0047

EPSS Percentile 36.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-798

Status published

Products (23)

cyberpower/powerpanel_server < 2.6.9

dataprobe/iboot-pdu4-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4-n20_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-c10_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-n15_firmware < 1.44.0804202

dataprobe/iboot-pdu4a-n20_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-c10_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-c20_firmware < 1.44.0804202

dataprobe/iboot-pdu4sa-n15_firmware < 1.44.0804202

... and 13 more

Published Aug 14, 2023

Tracked Since Feb 18, 2026