CVE-2022-33174 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Powertek PDU Web Interface Authorization Bypass. 💥 **Consequences**: Attackers bypass login screens to steal **cleartext** usernames & passwords. Critical data leak! 🔑

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Flawed session validation in `/cgi/get_param.cgi`. 🔍 **Flaw**: The system accepts an empty `tmpToken` cookie (`;`) to skip auth checks. No proper token verification! ❌

Q: Who is affected? (Versions/Components)

📦 **Affected**: Powertek PDU devices. 📉 **Version**: Firmware **before 3.30.30**. ⚠️ **Note**: Multiple brands may use this firmware! Check your version. 🏷️

Q: What can hackers do? (Privileges/Data)

🕵️ **Hackers Can**: Access protected fields `sys.passwd` and `sys.su.name`. 🔓 **Result**: Full admin credentials in **plaintext**. No encryption needed! 💀

Q: Is exploitation threshold high? (Auth/Config)

📊 **Threshold**: **LOW**. 🌐 **Auth**: None required (PR:N). 📡 **Network**: Remote (AV:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit! ⚡

Q: Is there a public Exp? (PoC/Wild Exploitation)

💻 **Public Exp**: **YES**. 🔗 **PoC**: Available on GitHub (Henry4E36) & Nuclei Templates. 🚀 **Status**: Actively exploitable via HTTP requests. 📡

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Send HTTP GET to `/cgi/get_param.cgi`. 🍪 **Cookie**: Set `tmpToken=` (empty + semicolon). 📥 **Result**: If you get JSON with `sys.passwd`, you're vulnerable! 🚩

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Upgrade firmware to **v3.30.30 or later**. ✅ **Official**: Patch released by Powertek. Update now! 🔄

Q: What if no patch? (Workaround)

🚧 **No Patch?**: Block external access to Web UI. 🔒 **Mitigation**: Restrict `/cgi/get_param.cgi` via firewall/WAF. 👀 **Monitor**: Alert on unauthorized config access. 🛡️

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 📈 **CVSS**: 9.8 (High). ⏳ **Action**: Patch immediately! Cleartext creds = instant compromise. 🏃💨

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Powertek PDU Web Interface Authorization Bypass. <br>💥 **Consequences**: Attackers bypass login screens to steal **cleartext** usernames & passwords. Critical data leak! 🔑

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Flawed session validation in `/cgi/get_param.cgi`. <br>🔍 **Flaw**: The system accepts an empty `tmpToken` cookie (`;`) to skip auth checks. No proper token verification! ❌

Q3Who is affected? (Versions/Components)

📦 **Affected**: Powertek PDU devices. <br>📉 **Version**: Firmware **before 3.30.30**. <br>⚠️ **Note**: Multiple brands may use this firmware! Check your version. 🏷️

Q4What can hackers do? (Privileges/Data)

🕵️ **Hackers Can**: Access protected fields `sys.passwd` and `sys.su.name`. <br>🔓 **Result**: Full admin credentials in **plaintext**. No encryption needed! 💀

Q5Is exploitation threshold high? (Auth/Config)

📊 **Threshold**: **LOW**. <br>🌐 **Auth**: None required (PR:N). <br>📡 **Network**: Remote (AV:N). <br>🎯 **Complexity**: Low (AC:L). Easy to exploit! ⚡

Q6Is there a public Exp? (PoC/Wild Exploitation)

💻 **Public Exp**: **YES**. <br>🔗 **PoC**: Available on GitHub (Henry4E36) & Nuclei Templates. <br>🚀 **Status**: Actively exploitable via HTTP requests. 📡

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Send HTTP GET to `/cgi/get_param.cgi`. <br>🍪 **Cookie**: Set `tmpToken=` (empty + semicolon). <br>📥 **Result**: If you get JSON with `sys.passwd`, you're vulnerable! 🚩

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Upgrade firmware to **v3.30.30 or later**. <br>✅ **Official**: Patch released by Powertek. Update now! 🔄

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Block external access to Web UI. <br>🔒 **Mitigation**: Restrict `/cgi/get_param.cgi` via firewall/WAF. <br>👀 **Monitor**: Alert on unauthorized config access. 🛡️

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>📈 **CVSS**: 9.8 (High). <br>⏳ **Action**: Patch immediately! Cleartext creds = instant compromise. 🏃💨

Continue exploring

Vulnerability detail Full AI analysis (login) n/a