CVE-2023-3264

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.

• cyberpower powerpanel server (< 2.6.9) • dataprobe iboot-pdu4a-c10 firmware (< 1.44.0804202) • dataprobe iboot-pdu4a-c20 firmware (< 1.44.0804202) • dataprobe iboot-pdu4a-n15 firmware (< 1.44.0804202) • dataprobe iboot-pdu4a-n20 firmware (< 1.44.0804202) • dataprobe iboot-pdu4-c20 firmware (< 1.44.0804202) • dataprobe iboot-pdu4-n20 firmware (< 1.44.0804202) • dataprobe iboot-pdu4sa-c10 firmware (< 1.44.0804202) • dataprobe iboot-pdu4sa-c20 firmware (< 1.44.0804202) • dataprobe iboot-pdu4sa-n15 firmware (< 1.44.0804202) • dataprobe iboot-pdu4sa-n20 firmware (< 1.44.0804202) • dataprobe iboot-pdu8a-2c10 firmware (< 1.44.0804202) • dataprobe iboot-pdu8a-2c20 firmware (< 1.44.0804202) • dataprobe iboot-pdu8a-2n15 firmware (< 1.44.0804202) • dataprobe iboot-pdu8a-2n20 firmware (< 1.44.0804202) • dataprobe iboot-pdu8a-c10 firmware (< 1.44.0804202) • dataprobe iboot-pdu8a-c20 firmware (< 1.44.0804202) • dataprobe iboot-pdu8a-n15 firmware (< 1.44.0804202) • dataprobe iboot-pdu8a-n20 firmware (< 1.44.0804202) • dataprobe iboot-pdu8sa-2n15 firmware (< 1.44.0804202) • dataprobe iboot-pdu8sa-c10 firmware (< 1.44.0804202) • dataprobe iboot-pdu8sa-n15 firmware (< 1.44.0804202) • dataprobe iboot-pdu8sa-n20 firmware (< 1.44.0804202)