CVE-2022-33174 : Power Distribution Units running on Powertek firmware (multiple brands) before 3

Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.

Published 2022-06-13 18:15:10

Updated 2022-06-27 16:45:56

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-33174

Powertekpdus » Basic Pdu Firmware
Versions before (<) 3.30.30
cpe:2.3:o:powertekpdus:basic_pdu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Powertekpdus » Basic Pdu » Version: N/A
Powertekpdus » Pm Pdu Firmware
Versions before (<) 3.30.30
cpe:2.3:o:powertekpdus:pm_pdu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Powertekpdus » Pm Pdu » Version: N/A
Powertekpdus » Piml Pdu Firmware
Versions before (<) 3.30.30
cpe:2.3:o:powertekpdus:piml_pdu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Powertekpdus » Piml Pdu » Version: N/A
Powertekpdus » Smart Pim Firmware
Versions before (<) 3.30.30
cpe:2.3:o:powertekpdus:smart_pim_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Powertekpdus » Smart Pim » Version: N/A
Powertekpdus » Smart Pos Firmware
Versions before (<) 3.30.30
cpe:2.3:o:powertekpdus:smart_pos_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Powertekpdus » Smart Pos » Version: N/A
Powertekpdus » Smart Pom Firmware
Versions before (<) 3.30.30
cpe:2.3:o:powertekpdus:smart_pom_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Powertekpdus » Smart Pom » Version: N/A
Powertekpdus » Smart Poms Firmware
Versions before (<) 3.30.30
cpe:2.3:o:powertekpdus:smart_poms_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Powertekpdus » Smart Poms » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-33174

EPSS FAQ

1.54%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 87 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-33174

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	MITRE
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-33174

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-33174

https://gynvael.coldwind.pl/?lang=en&id=748

Screams of Power vulnerabilities (Powertek-based PDUs) - gynvael.coldwind//vx.log
Exploit;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-33174

Products affected by CVE-2022-33174

Exploit prediction scoring system (EPSS) score for CVE-2022-33174

CVSS scores for CVE-2022-33174

CWE ids for CVE-2022-33174

References for CVE-2022-33174