PT-2022-21723 · Unknown+1 · Power Distribution Units+1

Gynvael Coldwind · Published 2022-06-13 · Updated 2022-09-02 · CVE-2022-33174

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Power Distribution Units running on Powertek firmware versions prior to 3.30.30

Description The issue allows remote authorization bypass in the web interface. An attacker can exploit this by sending an HTTP packet to the "cgi/get param.cgi" endpoint with the tmpToken cookie set to an empty string followed by a semicolon, bypassing an active session authorization check. This can then be used to fetch the values of protected fields sys.passwd and sys.su.name that contain the username and password in cleartext.

Recommendations For versions prior to 3.30.30, update to version 3.30.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the "cgi/get param.cgi" endpoint to minimize the risk of exploitation. Avoid using the tmpToken cookie with an empty string followed by a semicolon in the affected API endpoint until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-33174

Affected Products

Power Distribution Units

Powertek

References · 5

• 🔥 https://github.com/Henry4E36/CVE-2022-33174 · Exploit
• 🔥 https://gynvael.coldwind.pl/?lang=en&id=748 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-33174 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33174 · Vendor Advisory
• https://t.me/freedomf0x/17225 · Telegram Post