CVE-2022-33174
Last modified
CVE-2022-33174 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. EPSS estimates a 13.43% chance of exploitation in the next 30 days.
Description
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Powertekpdus | Basic Pdu Firmware | < 3.30.30 |
| Powertekpdus | Pm Pdu Firmware | < 3.30.30 |
| Powertekpdus | Piml Pdu Firmware | < 3.30.30 |
| Powertekpdus | Smart Pim Firmware | < 3.30.30 |
| Powertekpdus | Smart Pos Firmware | < 3.30.30 |
| Powertekpdus | Smart Pom Firmware | < 3.30.30 |
| Powertekpdus | Smart Poms Firmware | < 3.30.30 |
References
- https://gynvael.coldwind.pl/?lang=en&id=748Exploit, Third Party Advisory
- https://gynvael.coldwind.pl/?lang=en&id=748Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-33174?
How severe is CVE-2022-33174?
How do I fix CVE-2022-33174?
Are you affected by CVE-2022-33174?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST