by Kastro
Paper/Archive/CVE-2022-46738

CVE-2022-46738

Dataprobe, Inc. Dataprobe iBoot-PDU FW — CVE-2022-46738

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.8.478 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin.

Affected

ProductAffectedFixed inSource
Dataprobe iBoot-PDU FW< 1.42.061620221.42.06162022CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcisa.gov/news-events/ics-advisories/icsa-22-263-03refdataprobe.com/support/iboot-pdu/local_upgrade_pdu_procedure.pdf