PT-2023-23923 · Dataprobe · Dataprobe Iboot Pdu

Sam Quinn · Published 2023-08-13 · Updated 2023-08-22 · CVE-2023-3263

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dataprobe iBoot PDU version 1.43.03312023 or earlier

Description The issue concerns authentication bypass in the REST API due to the mishandling of special characters when parsing credentials. Successful exploitation allows a malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution.

Recommendations For version 1.43.03312023 or earlier, consider disabling the REST API until a patch is available to prevent exploitation. Restrict access to the API endpoints to minimize the risk of unauthorized access. Avoid using special characters in credentials for the affected API until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-289

CWE-287

Related Identifiers

CVE-2023-3263

Affected Products

Dataprobe Iboot Pdu

References · 7

• https://osv.dev/vulnerability/CVE-2023-3263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3263 · Security Note
• https://trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html · Vendor Advisory
• https://t.me/cvenotify/56392 · Telegram Post
• https://twitter.com/cracbot/status/1691328922863177728 · Twitter Post
• https://t.me/cibsecurity/68428 · Telegram Post
• https://twitter.com/CVEnew/status/1690940850828619776 · Twitter Post