Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm): The IntelliSlot card

Impact

The IntelliSlot card is the network brain bolted into Liebert CRAC/CRAH units, condensers and thermal management gear. A remote attacker can reconfigure its access control and telnet settings by hitting the config pages directly, which means they can create their own administrative access and keep it. From there the card exposes the unit's operating parameters - fan command, compressor enable, setpoints, alarm relays. Turning off or de-rating the CRAHs serving a GPU hall is a fleet-wide availability kill: the racks do not have hours of ride-through, they have minutes. Equally damaging and much quieter is suppressing the alarm path, so the operations team's first indication of a thermal event is GPUs dropping off the fabric rather than a temperature alarm.

Who can reach it

Remote HTTP to the card, no authentication. These cards live on the facility monitoring VLAN alongside the PDU network cards and environmental sensors. Many operators inherited that VLAN from the building and treat it as trusted. Note that IntelliSlot cards are frequently also reachable from the DCIM/monitoring server, so compromise of a monitoring host is a direct path in.

What to do

Replace the card. The IntelliSlot Web Card generation covered here is end-of-life; Vertiv's answer is migration to a current Unity/IS-UNITY card, which is a hardware swap per cooling unit and needs the unit taken off network (not necessarily off cooling). Until then: isolate the card VLAN, block telnet outright at the switch, and put an ACL so only the DCIM collector can reach the card's HTTP port. If you lease, this is landlord equipment - ask for the card model and firmware inventory in writing and treat 'IntelliSlot Web Card' in the answer as a finding.

References