Critical · published June 13, 2022
🚨 A simple empty cookie can unlock your Power Distribution Unit like a master key! 🔥 Think of it like a hotel front desk that hands over room keys without checking IDs — one clever trick, and an attacker could access sensitive areas without any verification. An attacker can gain direct access to critical information, including user credentials stored in cleartext. This could lead to unauthorized control over the entire power management system, potentially causing chaos in essential operations and exposing sensitive data.
Think of it like a hotel front desk that hands over room keys without checking IDs — one clever trick, and an attacker could access sensitive areas without any verification. This vulnerability allows remote authorization bypass through the web interface of Power Distribution Units running on Powertek firmware before version 3.30.30. By sending a crafted HTTP packet with a specific cookie format, attackers can bypass active session checks and retrieve sensitive information.
An attacker can gain direct access to critical information, including user credentials stored in cleartext. This could lead to unauthorized control over the entire power management system, potentially causing chaos in essential operations and exposing sensitive data. Immediately update the firmware to version 3.30.30 or later to close this critical vulnerability. Additionally, review system configurations and monitor for any unauthorized access attempts to your units. Make sure to implement strict network controls around these devices to limit exposure. You've got this! Follow these steps, and your systems will be secure in no time! 🛡️