CVE-2022-3186
Last modified
CVE-2022-3186 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main management page from the cloud. This feature enables users to remotely connect devices, however, the current implementation permits users to access other device's information. . EPSS estimates a 0.57% chance of exploitation in the next 30 days.
Description
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main management page from the cloud. This feature enables users to remotely connect devices, however, the current implementation permits users to access other device's information.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dataprobe | Iboot-Pdu4-N20 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu4sa-N15 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu4a-N15 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu4sa-N20 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu4a-N20 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu8sa-N15 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu8a-N15 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu8sa-2n15 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu8a-2n15 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu8sa-N20 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu8a-N20 Firmware | < 1.42.06162022 |
| Dataprobe | Iboot-Pdu8a-2n20 Firmware | < 1.42.06162022 |
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03Patch, Third Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03Patch, Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3186?
How severe is CVE-2022-3186?
How do I fix CVE-2022-3186?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-31846A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R…7.5
- CVE-2022-31847A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK …7.5
- CVE-2022-31849MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discove…8.8
- CVE-2022-3185Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 conta…5.3
- CVE-2022-31854Codoforum v5.1 was discovered to contain an arbitrary file u…7.2
- CVE-2022-31856Newsletter Module v3.x was discovered to contain a SQL injec…9.8
- CVE-2022-31860An issue was discovered in OpenRemote through 1.0.4 allows a…9.8
- CVE-2022-31861Cross site Scripting (XSS) in ThingsBoard IoT Platform throu…5.4
- CVE-2022-3187Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 conta…5.3
- CVE-2022-31873Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an X…6.1
- CVE-2022-31874ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnera…9.8
- CVE-2022-31875Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an x…6.1
Are you affected by CVE-2022-3186?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST