CVE-2022-33174
Critical
Description
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
SeverityCritical
CVSS9.8
Exploit probability—
ProductPowertekpdus Basic Pdu Firmware
PublishedJun 13, 2022
First seenJun 13, 2022
How to fix
Update
- powertekpdus basic_pdu_firmware3.30.30 or later
- powertekpdus pm_pdu_firmware3.30.30 or later
- powertekpdus piml_pdu_firmware3.30.30 or later
- powertekpdus smart_pim_firmware3.30.30 or later
- powertekpdus smart_pos_firmware3.30.30 or later
- powertekpdus smart_pom_firmware3.30.30 or later
- powertekpdus smart_poms_firmware3.30.30 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| powertekpdus basic_pdu_firmware | v < 3.30.30 | 3.30.30 |
| powertekpdus pm_pdu_firmware | v < 3.30.30 | 3.30.30 |
| powertekpdus piml_pdu_firmware | v < 3.30.30 | 3.30.30 |
| powertekpdus smart_pim_firmware | v < 3.30.30 | 3.30.30 |
| powertekpdus smart_pos_firmware | v < 3.30.30 | 3.30.30 |
| powertekpdus smart_pom_firmware | v < 3.30.30 | 3.30.30 |
| powertekpdus smart_poms_firmware | v < 3.30.30 | 3.30.30 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.