Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-06-13T17:03:47

Updated: 2024-08-03T08:01:20.393Z

Reserved: 2022-06-13T00:00:00

Link: CVE-2022-33175

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-06-13T18:15:10.283

Modified: 2024-11-21T07:07:39.347

Link: CVE-2022-33175

cve-icon Redhat

No data.