CVE-2023-3260: Cyberpower Powerpanel Server

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.

Affected products

  • Cyberpower Powerpanel Server: before 2.6.9 (fixed in 2.6.9)
  • Dataprobe Iboot-PDU4-c20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4-n20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4A-c10 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4A-c20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4A-n15 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4A-n20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4SA-c10 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4SA-c20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4SA-n15 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU4SA-n20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8A-2c10 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8A-2c20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8A-2n15 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8A-2n20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8A-c10 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8A-c20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8A-n15 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8A-n20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8SA-2n15 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8SA-c10 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8SA-n15 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)
  • Dataprobe Iboot-PDU8SA-n20 Firmware: before 1.44.0804202 (fixed in 1.44.0804202)

Published 2023-08-14. Last modified 2026-06-17.