CVE-2023-3263

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-289 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-326329.8A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108. A specially crafted CVE-2023-326336.7Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially e CVE-2023-326347.4An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An att CVE-2023-326355.5XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). By processing a specially cr CVE-2023-326367.5A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input valida CVE-2023-326379.8GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyo CVE-2023-326387.8Incorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated user to potentially e CVE-2023-326395.5Applicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML fi CVE-2023-32649.8The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal CVE-2023-326418.8Improper input validation in firmware for Intel(R) QAT before version QAT20.L.1.0.40-00004 may allow escalation of privilege and denial of s CVE-2023-326426.5Insufficient adherence to expected conventions for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.24 CVE-2023-326437.8A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665