VulnerabilityModified
CVE-2023-3260
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter.
HIGH 8.8EPSS 1.26%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.26% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- cyberpower/powerpanel server · dataprobe/iboot-pdu4a-c10 firmware · dataprobe/iboot-pdu4a-c20 firmware · dataprobe/iboot-pdu4a-n15 firmware · dataprobe/iboot-pdu4a-n20 firmware · dataprobe/iboot-pdu4-c20 firmware · dataprobe/iboot-pdu4-n20 firmware · dataprobe/iboot-pdu4sa-c10 firmware · dataprobe/iboot-pdu4sa-c20 firmware · dataprobe/iboot-pdu4sa-n15 firmware · dataprobe/iboot-pdu4sa-n20 firmware · dataprobe/iboot-pdu8a-2c10 firmware · dataprobe/iboot-pdu8a-2c20 firmware · dataprobe/iboot-pdu8a-2n15 firmware · dataprobe/iboot-pdu8a-2n20 firmware · dataprobe/iboot-pdu8a-c10 firmware · dataprobe/iboot-pdu8a-c20 firmware · dataprobe/iboot-pdu8a-n15 firmware · dataprobe/iboot-pdu8a-n20 firmware · dataprobe/iboot-pdu8sa-2n15 firmware · +3 more
- Source
- trellixpsirt@trellix.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.