Raritan PX rack PDU (before firmware 1.5.11, DPXR20A-16 and related PX models): TENANT ISOLATION: the PDU's IPMI

Impact

TENANT ISOLATION: the PDU's IPMI interface accepts 'cipher suite 0' (aka cipher zero), a known-broken IPMI auth mode that accepts any password. An attacker who reaches the IPMI port can issue arbitrary IPMI commands with no valid credential — including power-control commands to cut or cycle outlets feeding whatever racks that PDU serves, tenant-owned or not.

Who can reach it

Fully remote and unauthenticated over the network-reachable IPMI port — the attacker just needs to request cipher suite 0 and supply any password; the PDU accepts it.

What to do

Firmware upgrade to 1.5.11 or later, which disables cipher-zero support. If a firmware upgrade isn't immediately possible, a network-segmentation change to firewall off the IPMI port from anything but a trusted management VLAN is the compensating control — this is the same 'IPMI cipher zero' class of bug that hit many BMC vendors around the same era, so audit for other devices on the same segment too. Flash each PDU one at a time; outlets keep powering their load during the update, but remote power-control briefly drops.

References