Filtered by vendor Powertekpdus Subscriptions
Filtered by product Basic Pdu Firmware Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-33175 1 Powertekpdus 14 Basic Pdu, Basic Pdu Firmware, Piml Pdu and 11 more 2024-11-21 9.8 Critical
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.
CVE-2022-33174 1 Powertekpdus 14 Basic Pdu, Basic Pdu Firmware, Piml Pdu and 11 more 2024-11-21 9.8 Critical
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.