CVEvulnerability

CVE-2022-33174

7.5 HIGH Published 2022-06-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-06-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-863

Description

Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.

Affected configurations

• powertekpdus basic pdu firmware (< 3.30.30) • powertekpdus pm pdu firmware (< 3.30.30) • powertekpdus piml pdu firmware (< 3.30.30) • powertekpdus smart pim firmware (< 3.30.30) • powertekpdus smart pos firmware (< 3.30.30) • powertekpdus smart pom firmware (< 3.30.30) • powertekpdus smart poms firmware (< 3.30.30)

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References