CVE-2023-3260

Summary

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the user-name URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.

Affected Software

Weaknesses

• CWE-78: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

ADP Enrichment

CVE Program Container

Additional References

• https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html

• ←Previous
• Next→