PT-2023-2478 · Aten · Aten Pe8108

Martin Schobert · Published 2023-02-06 · Updated 2023-04-14 · CVE-2023-25413

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aten PE8108 version 2.4.232

Description The issue is related to insufficient protection of registration data in the web interface of the Aten PE8108 power distribution unit (PDU) software. This allows for unauthenticated access to Telnet and SNMP credentials. An attacker can exploit this issue remotely to gain access to these credentials.

Recommendations For Aten PE8108 version 2.4.232, consider restricting access to the device until a patch is available, and avoid using the Telnet and SNMP credentials in the affected web interface. As a temporary workaround, restrict access to the web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Improper Access Control

Weakness Enumeration

CWE-522

CWE-284

Related Identifiers

BDU:2023-02269

CVE-2023-25413

Affected Products

Aten Pe8108

References · 5

• 🔥 https://pentagrid.ch/en/blog/multiple-vulnerabilities-in-aten-PE8108-power-distribution-unit · Exploit
• https://bdu.fstec.ru/vul/2023-02269 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25413 · Security Note
• https://vuldb.com/?id.225675 · Note