Deserialization in Dataprobe Iboot Pdu
CVE-2023-3259
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information
Vulnerability class: Insecure Deserialization
EPSS: 0.010 (58.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Dataprobe Iboot Pdu — versions 1.43.03312023
- Dataprobe Iboot-pdu4a-c10
- Dataprobe Iboot-pdu4a-c10_firmware
- Dataprobe Iboot-pdu4a-c20
- Dataprobe Iboot-pdu4a-c20_firmware
- Dataprobe Iboot-pdu4a-n15
- Dataprobe Iboot-pdu4a-n15_firmware
- Dataprobe Iboot-pdu4a-n20
- Dataprobe Iboot-pdu4a-n20_firmware
- Dataprobe Iboot-pdu4-c20
Weakness classification (CWE)
References
- trellixpsirt@trellix.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-3259?
- CVE-2023-3259 is a critical-severity vulnerability in Dataprobe Iboot Pdu, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2023-08-14.
- How severe is CVE-2023-3259?
- Critical severity. CVSS v3 base score is 9.8 out of 10.