1. Home
  2. CVE Database
  3. CVE-2022-33174
CRITICAL · 9.8

CVE-2022-33174

Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an H...

Vulnerability Description

Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
PowertekpdusBasic Pdu Firmware< 3.30.30
PowertekpdusBasic Pdu-
PowertekpdusPm Pdu Firmware< 3.30.30
PowertekpdusPm Pdu-
PowertekpdusPiml Pdu Firmware< 3.30.30
PowertekpdusPiml Pdu-
PowertekpdusSmart Pim Firmware< 3.30.30
PowertekpdusSmart Pim-
PowertekpdusSmart Pos Firmware< 3.30.30
PowertekpdusSmart Pos-
PowertekpdusSmart Pom Firmware< 3.30.30
PowertekpdusSmart Pom-
PowertekpdusSmart Poms Firmware< 3.30.30
PowertekpdusSmart Poms-

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2022-33174?

CVE-2022-33174 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an H...

How severe is CVE-2022-33174?

CVE-2022-33174 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-33174?

Check the references section above for vendor advisories and patch information. Affected products include: Powertekpdus Basic Pdu Firmware, Powertekpdus Basic Pdu, Powertekpdus Pm Pdu Firmware, Powertekpdus Pm Pdu, Powertekpdus Piml Pdu Firmware.