PT-2022-20970 · Dataprobe · Dataprobe Iboot Pdu

Claroty Research + 1 · Published 2022-12-21 · Updated 2022-12-28 · CVE-2022-3188

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dataprobe iBoot-PDU FW versions prior to 1.42.06162022

Description The issue allows unauthenticated users to open PHP index pages without authentication and download the history file from the device. The history file includes the latest actions completed by specific users.

Recommendations For versions prior to 1.42.06162022, update to version 1.42.06162022 or later to resolve the issue. As a temporary workaround, consider restricting access to PHP index pages to prevent unauthorized downloads of the history file.

Fix

Incorrect Authorization

Missing Authentication

Weakness Enumeration

CWE-863

CWE-306

Related Identifiers

CVE-2022-3188

Affected Products

Dataprobe Iboot Pdu

References · 5

• https://cisa.gov/uscert/ics/advisories/icsa-22-263-03 · Patch
• https://osv.dev/vulnerability/CVE-2022-3188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3188 · Security Note
• https://t.me/cibsecurity/55101 · Telegram Post
• https://t.me/cvenotify/40393 · Telegram Post