Data centre PDU Dataprobe iBoot fixes Vulnerabilities including one critical
Take action: It's never great news if your datacenter systems start randomly turning on and off because someone has hijacked your PDU. Lock down the PDU network in an internal secure network, isolate it in a separate VLAN that's not allowed to roam around the rest of the network; shut off SNMP if not used, and naturally - patch the iBoot PDU.
Learn More
Trellix Advanced Research Center identified critical vulnerabilities in Dataprobe's iBoot Power Distribution Unit (PDU). These vulnerabilities, when exploited in combination, could provide attackers with comprehensive access to the affected systems.
Such access could enable the attackers to cause substantial damage: the iBoot PDU was found to be susceptible to remote code injection, potentially serving as an entry point to a broader network of connected data center devices and enterprise systems.
The following vulnerabilities were discovered in Dataprobe's iBoot PDU:
- CVE-2023-3259 (CVSS score 9.8): Deserialization of Untrusted Data (Auth Bypass)
- CVE-2023-3261 (CVSS score 7.5): Buffer Overflow (DoS)
- CVE-2023-3263 (CVSS 7.5): Authentication Bypass by Alternate Name (Auth Bypass)
- CVE-2023-3260 (CVSS score 7.2): OS Command Injection (Authenticated RCE)
- CVE-2023-3262: (CVSS score 6.7): Use of Hard-coded Credentials
The potential consequences of these vulnerabilities extend beyond the immediate impact on the iBoot PDU itself. Compromised iBoot PDUs could serve as entry points to launch attacks on a larger scale, affecting connected devices and enterprise networks. This potential for widespread damage highlights the importance of promptly addressing and resolving these vulnerabilities to ensure the security and stability of data center operations and connected systems.
Dataprobe has introduced the following version update as a remedy to address these identified vulnerabilities:
iBoot-PDU Firmware: Version 1.43.03312023
Detailed instructions for performing the upgrade can be accessed on Dataprobe's official website.
Furthermore, Dataprobe advises users to consider deactivating SNMP if it is not currently in use.
