The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
cyberpower powerpanel server |
||
dataprobe iboot-pdu4a-c10_firmware |
||
dataprobe iboot-pdu4a-c20_firmware |
||
dataprobe iboot-pdu4a-n15_firmware |
||
dataprobe iboot-pdu4a-n20_firmware |
||
dataprobe iboot-pdu4-c20_firmware |
||
dataprobe iboot-pdu4-n20_firmware |
||
dataprobe iboot-pdu4sa-c10_firmware |
||
dataprobe iboot-pdu4sa-c20_firmware |
||
dataprobe iboot-pdu4sa-n15_firmware |
||
dataprobe iboot-pdu4sa-n20_firmware |
||
dataprobe iboot-pdu8a-2c10_firmware |
||
dataprobe iboot-pdu8a-2c20_firmware |
||
dataprobe iboot-pdu8a-2n15_firmware |
||
dataprobe iboot-pdu8a-2n20_firmware |
||
dataprobe iboot-pdu8a-c10_firmware |
||
dataprobe iboot-pdu8a-c20_firmware |
||
dataprobe iboot-pdu8a-n15_firmware |
||
dataprobe iboot-pdu8a-n20_firmware |
||
dataprobe iboot-pdu8sa-2n15_firmware |
||
dataprobe iboot-pdu8sa-c10_firmware |
||
dataprobe iboot-pdu8sa-n15_firmware |
||
dataprobe iboot-pdu8sa-n20_firmware |
Vulmon