high7.2
CVE-2023-3260
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter.
Impact
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cyberpower | Powerpanel Server | before 2.6.9 |
| Dataprobe | Iboot-Pdu4a-C10 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4a-C20 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4a-N15 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4a-N20 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4-C20 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4-N20 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4sa-C10 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4sa-C20 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4sa-N15 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu4sa-N20 Firmware | before 1.44.0804202 |
| Dataprobe | Iboot-Pdu8a-2c10 Firmware | before 1.44.0804202 |