Login Request a demo
High severity · published Dec 21, 2022
CVE-2022-3186
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main management page from the…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main management page from the cloud. This feature enables users to remotely connect devices, however, the current implementation permits users to access other device's information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
iBoot-PDU FW · Dataprobe
through 1.42.06162022 · source: vendor
IF
Iboot-pdu4-n20 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu4a-n15 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu4a-n20 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu4sa-n15 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu4sa-n20 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu8a-2n15 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu8a-2n20 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu8a-n15 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu8a-n20 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu8sa-2n15 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
IF
Iboot-pdu8sa-n15 Firmware · Dataprobe
before 1.42.06162022 · source: NVD
Affected product
IF
iBoot-PDU FW
Dataprobe
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3186
Patch
https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
More from iBoot-PDU FW
9.8
CVE-2022-3184
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to access an old PHP page…
9.8
CVE-2022-3183
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provided by the user, which may expose the…
5.3
CVE-2022-3189
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL…
5.3
CVE-2022-3188
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication and download the…
5.3
CVE-2022-3187
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connection is established with the database