Critical severity9.8NVD Advisory· Published Jun 13, 2022· Updated Jun 17, 2026
CVE-2022-33175
CVE-2022-33175
Description
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Powertek/Power Distribution Unitsdescription
Patches
Vulnerability mechanics
References
1- gynvael.coldwind.plnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.