← Vulnerability feed

Vulnerability record · CVE-2023-3259 · published 14 August 2023

CVE-2023-3259: Dataprobe iboot-pdu4a-c10 firmware deserialization of untrusted data vulnerability

Dataprobe · Iboot Pdu4a C10 Firmware

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information

9.8 CVSS 3.1 Critical EPSS 0.95% · top 40.2% CWE-502 · Deserialization of untrusted data
9.8CVSS 3.1 base score
0.95%EPSS exploitation probability, 30 days
NoNot in CISA KEV
22Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

22 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html Vendor Advisory
https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html Vendor Advisory

Track CVE-2023-3259 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-3264Cyberpower powerpanel server hard-coded credentials vulnerabilityThe Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres…EPSS 0.47%9.8CVE-2022-46658Dataprobe iboot-pdu4-n20 firmware vulnerabilityThe affected product is vulnerable to a stack-based buffer overflow which could lead to a denial of service or remote code execution.EPSS 1.2%9.8CVE-2022-46738Dataprobe iboot-pdu4-n20 firmware vulnerabilityThe affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address a…EPSS 0.58%9.8CVE-2022-3183Dataprobe iboot-pdu4-n20 firmware os command injection vulnerabilityDataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provided by the …EPSS 1.6%9.8CVE-2022-3184Dataprobe iboot-pdu4-n20 firmware path traversal vulnerabilityDataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to a…EPSS 12%8.8CVE-2023-3260Cyberpower powerpanel server os command injection vulnerabilityThe Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An au…EPSS 1.3%8.8CVE-2022-47311Dataprobe iboot-pdu4-n20 firmware vulnerabilityA proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contain…EPSS 0.52%8.1CVE-2022-47320Dataprobe iboot-pdu4-n20 firmware vulnerabilityThe iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on …EPSS 0.51%

Source: NIST National Vulnerability Database (record CVE-2023-3259), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.