Skip to content
OpenAdvisories
Critical ICSA-22-263-03 12 CVEs

Dataprobe iBoot-PDU

Published Sep 20, 2022 · Updated May 4, 2023 · Revision 2

Vendor: Dataprobe Product: iBoot-PDU FW

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-22-263-03 Dataprobe iBoot-PDU that was published September 20, 2022, on the ICS webpage on cisa.gov/ICS.

Vulnerabilities 12

  • Critical 9.8
    CVE-2022-3183

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanit…

    Dataprobe iBoot-PDU FW
  • Critical 9.8
    CVE-2022-3184 EPSS 12%

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware all…

    Dataprobe iBoot-PDU FW
  • High 8.6
    CVE-2022-3186

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an att…

    Dataprobe iBoot-PDU FW
  • High 8.5
    CVE-2022-47311

    CVE-2022-47311

    A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for usernam…

    Dataprobe Dataprobe iBoot-PDU FW
  • High 8.1
    CVE-2022-47320

    CVE-2022-47320

    The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.

    Dataprobe Dataprobe iBoot-PDU FW
  • High 7.2
    CVE-2022-46738

    CVE-2022-46738

    The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin.

    Dataprobe Dataprobe iBoot-PDU FW
  • Medium 6.5
    CVE-2022-46658

    CVE-2022-46658

    The affected product is vulnerable to a stack-based buffer overflow which could lead to a denial of service or remote code execution.

    Dataprobe Dataprobe iBoot-PDU FW
  • Medium 6.5
    CVE-2022-4945

    CVE-2022-4945

    The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud.

    Dataprobe Dataprobe iBoot-PDU FW
  • Medium 5.3
    CVE-2022-3185

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensi…

    Dataprobe iBoot-PDU FW
  • Medium 5.3
    CVE-2022-3187

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate wh…

    Dataprobe iBoot-PDU FW
  • Medium 5.3
    CVE-2022-3188

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open P…

    Dataprobe iBoot-PDU FW
  • Medium 5.3
    CVE-2022-3189

    Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script cou…

    Dataprobe iBoot-PDU FW

Revision history

  1. #2

    CSAF Update Date

  2. #1

    Previous Publication Date

References