9.8

CVE-2022-33175

Exploit
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Powertekpdus ≫ Basic Pdu Firmware Version < 3.30.30
   Powertekpdus ≫ Basic Pdu Version -
Powertekpdus ≫ Pm Pdu Firmware Version < 3.30.30
   Powertekpdus ≫ Pm Pdu Version -
Powertekpdus ≫ Piml Pdu Firmware Version < 3.30.30
   Powertekpdus ≫ Piml Pdu Version -
Powertekpdus ≫ Smart Pim Firmware Version < 3.30.30
   Powertekpdus ≫ Smart Pim Version -
Powertekpdus ≫ Smart Pos Firmware Version < 3.30.30
   Powertekpdus ≫ Smart Pos Version -
Powertekpdus ≫ Smart Pom Firmware Version < 3.30.30
   Powertekpdus ≫ Smart Pom Version -
Powertekpdus ≫ Smart Poms Firmware Version < 3.30.30
   Powertekpdus ≫ Smart Poms Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.73% 0.754
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
MITRE 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://gynvael.coldwind.pl/?lang=en&id=748
Third Party Advisory
Exploit