CVE-2022-33174 Scanner
Detects 'Authorization Bypass' vulnerability in Powertek firmware affects v. before 3.30.30.
Used 2.3k times · 5.9k assets checked · domain, ipv4, subdomain
CVE
CVE-2022-33174
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
Updated Sep 22, 2026View on NVD →
S4E scanner
Monitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →