Lucene search

TrellixCVELIST:CVE-2023-3264

HistoryAug 14, 2023 - 4:05 a.m.

CVE-2023-3264

2023-08-1404:05:58

CWE-798

trellix

www.cve.org

dataprobe iboot pdu

firmware vulnerability

hard-coded credentials

postgres database

os commands

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.3%

JSON

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "iBoot PDU",
    "vendor": "Dataprobe",
    "versions": [
      {
        "status": "affected",
        "version": "v2.6.0"
      }
    ]
  }
]

References

www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.3%

JSON

Related for CVELIST:CVE-2023-3264