CVE-2022-33175

Name: CVE-2022-33175
Creator: NVD / NIST
Published: 2022-06-13T18:15:10.283+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 1.66%

Last modified Jun 17, 2026

CVE-2022-33175 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. EPSS estimates a 1.66% chance of exploitation in the next 30 days.

Description

Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.66%

73.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-732

Affected Software

Vendor	Product	Versions
Powertekpdus	Basic Pdu Firmware	< 3.30.30
Powertekpdus	Pm Pdu Firmware	< 3.30.30
Powertekpdus	Piml Pdu Firmware	< 3.30.30
Powertekpdus	Smart Pim Firmware	< 3.30.30
Powertekpdus	Smart Pos Firmware	< 3.30.30
Powertekpdus	Smart Pom Firmware	< 3.30.30
Powertekpdus	Smart Poms Firmware	< 3.30.30

References

https://gynvael.coldwind.pl/?lang=en&id=748Exploit, Third Party Advisory
https://gynvael.coldwind.pl/?lang=en&id=748Exploit, Third Party Advisory

Timeline

Published: Jun 13, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-33175?

How severe is CVE-2022-33175?

CVE-2022-33175 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.66% probability of exploitation in the next 30 days.

How do I fix CVE-2022-33175?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-33175?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST