CVE Feed

    Dashboard / CVE / CVE-2023-3259

    CVE-2023-3259

    The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information

    Published:Aug 14, 2023
    Last Modified:Nov 21, 2024
    EPS:Aug 14, 2023
    EPSS Score:0.00154
    CVSS Score:9.8

    Affected Products

    Vendor
    Dataprobe
    Product
    Iboot-pdu4-c20
    Vendor
    Dataprobe
    Product
    Iboot-pdu4-c20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4-n20
    Vendor
    Dataprobe
    Product
    Iboot-pdu4-n20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4a-c10
    Vendor
    Dataprobe
    Product
    Iboot-pdu4a-c10 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4a-c20
    Vendor
    Dataprobe
    Product
    Iboot-pdu4a-c20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4a-n15
    Vendor
    Dataprobe
    Product
    Iboot-pdu4a-n15 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4a-n20
    Vendor
    Dataprobe
    Product
    Iboot-pdu4a-n20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4sa-c10
    Vendor
    Dataprobe
    Product
    Iboot-pdu4sa-c10 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4sa-c20
    Vendor
    Dataprobe
    Product
    Iboot-pdu4sa-c20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4sa-n15
    Vendor
    Dataprobe
    Product
    Iboot-pdu4sa-n15 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu4sa-n20
    Vendor
    Dataprobe
    Product
    Iboot-pdu4sa-n20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-2c10
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-2c10 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-2c20
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-2c20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-2n15
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-2n15 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-2n20
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-2n20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-c10
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-c10 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-c20
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-c20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-n15
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-n15 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-n20
    Vendor
    Dataprobe
    Product
    Iboot-pdu8a-n20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8sa-2n15
    Vendor
    Dataprobe
    Product
    Iboot-pdu8sa-2n15 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8sa-c10
    Vendor
    Dataprobe
    Product
    Iboot-pdu8sa-c10 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8sa-n15
    Vendor
    Dataprobe
    Product
    Iboot-pdu8sa-n15 Firmware
    Vendor
    Dataprobe
    Product
    Iboot-pdu8sa-n20
    Vendor
    Dataprobe
    Product
    Iboot-pdu8sa-n20 Firmware
    Vendor
    Dataprobe
    Product
    Iboot Pdu

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2023-3264 (CVSS 6.7) — The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all …
    CVE-2023-3263 (CVSS 7.5) — The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypa…
    CVE-2023-3262 (CVSS 6.7) — The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all …
    CVE-2023-3261 (CVSS 7.5) — The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerabi…
    CVE-2023-3260 (CVSS 7.2) — The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection v…
    CVE-2022-46658 (CVSS 6.5) — The affected product is vulnerable to a stack-based buffer overflow which could lead to a denial of service or…
    CVE-2022-46738 (CVSS 7.2) — The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the S…
    CVE-2022-47320 (CVSS 8.1) — The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol sh…
    CVE-2022-47311 (CVSS 8.5) — A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the…
    CVE-2022-4945 (CVSS 6.5) — The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High