Critical · published June 13, 2022
🚨 An unsecured user.token field could let attackers impersonate administrators within Power Distribution Units running outdated Powertek firmware! 🔥 Think of it like a hotel room where the keycard works for anyone — not just the guests! Anyone with the right URL can walk right in and access sensitive admin controls without even a knock. This glaring vulnerability can lead to unauthorized access to active session IDs of logged-in administrators. An attacker could bypass authentication entirely, read cleartext passwords, and reconfigure the device, leaving your systems wide open to catastrophic misconfigurations or data breaches.
Think of it like a hotel room where the keycard works for anyone — not just the guests! Anyone with the right URL can walk right in and access sensitive admin controls without even a knock. The issue stems from an insecure permissions setting on the user.token field accessible via the /cgi/get_param.cgi HTTP API, allowing anyone to retrieve sensitive session information without proper authentication.
This glaring vulnerability can lead to unauthorized access to active session IDs of logged-in administrators. An attacker could bypass authentication entirely, read cleartext passwords, and reconfigure the device, leaving your systems wide open to catastrophic misconfigurations or data breaches. Upgrade your Powertek firmware to version 3.30.30 or later immediately to close this vulnerability. Review access controls and audit configurations to ensure unauthorized access is prevented going forward. Don't forget to educate your team on secure API practices! You've got this! With these steps, you'll patch this vulnerability and keep your systems secure! 🛡️