CVE-2022-4945 CVE-2022-4945
Attackers with local file access can read plaintext cloud credentials, compromising other connected devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4945?
CVE-2022-4945 is a medium-severity vulnerability in Dataprobe, Inc. Dataprobe iBoot-PDU FW, published on 22 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud.
Which versions are affected by CVE-2022-4945?
It affects 22 products.
Products include Dataprobe Iboot-Pdu4-C20 Firmware, Dataprobe Iboot-Pdu4-N20 Firmware, Dataprobe Iboot-Pdu4a-C10 Firmware, Dataprobe Iboot-Pdu4a-C20 Firmware, Dataprobe Iboot-Pdu4a-N15 Firmware, Dataprobe Iboot-Pdu4a-N20 Firmware and 16 more.
How do I fix CVE-2022-4945?
No fix has been published for CVE-2022-4945 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4945 being exploited?
There is no known exploitation of CVE-2022-4945 in the wild and no public exploit code.
Other vulnerabilities in Dataprobe, Inc. Dataprobe iBoot-PDU FW
Sources
Also known as GHSA-gx4c-qrx5-9w6f.