The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-3259
• https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html