Powertekpdus Basic Pdu Firmware vulnerabilities

CVE-2022-33174 [HIGH] CWE-863 CVE-2022-33174: Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an

CVE-2022-33175 [CRITICAL] CWE-732 CVE-2022-33175: Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insec Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as th