CVE-2022-33175: Powertekpdus Basic Pdu Firmware

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.

Affected products

• Powertekpdus Basic Pdu Firmware: before 3.30.30 (fixed in 3.30.30)
• Powertekpdus Piml Pdu Firmware: before 3.30.30 (fixed in 3.30.30)
• Powertekpdus Pm Pdu Firmware: before 3.30.30 (fixed in 3.30.30)
• Powertekpdus Smart Pim Firmware: before 3.30.30 (fixed in 3.30.30)
• Powertekpdus Smart Pom Firmware: before 3.30.30 (fixed in 3.30.30)
• Powertekpdus Smart Poms Firmware: before 3.30.30 (fixed in 3.30.30)
• Powertekpdus Smart Pos Firmware: before 3.30.30 (fixed in 3.30.30)

Published 2022-06-13. Last modified 2026-06-17.