CVE-2023-3260
moderate-risk
Published 2023-08-14
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.
Do I need to act?
-
0.45% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10
High
NETWORK
/ LOW complexity
Affected Products (20)
Powerpanel Server
Iboot-Pdu4A-C10 Firmware
Iboot-Pdu4A-C20 Firmware
Iboot-Pdu4A-N15 Firmware
Iboot-Pdu4A-N20 Firmware
Iboot-Pdu4-C20 Firmware
Iboot-Pdu4-N20 Firmware
Iboot-Pdu4Sa-C10 Firmware
Iboot-Pdu4Sa-C20 Firmware
Iboot-Pdu4Sa-N15 Firmware
Iboot-Pdu4Sa-N20 Firmware
Iboot-Pdu8A-2C10 Firmware
Iboot-Pdu8A-2C20 Firmware
Iboot-Pdu8A-2N15 Firmware
Iboot-Pdu8A-2N20 Firmware
Iboot-Pdu8A-C10 Firmware
Iboot-Pdu8A-C20 Firmware
Iboot-Pdu8A-N15 Firmware
Iboot-Pdu8A-N20 Firmware
Iboot-Pdu8Sa-2N15 Firmware
Affected Vendors
References (2)
49
/ 100
moderate-risk
Severity
26/34 · High
Exploitability
2/34 · Minimal
Exposure
21/34 · High