Raritan CommandCenter Secure Gateway (CC-SG), before 8.0.0: CC-SG is Raritan's single-pane-of-glass gateway that

Impact

CC-SG is Raritan's single-pane-of-glass gateway that brokers KVM and serial console access across a whole fleet of Dominion KX/SX switches. An unauthenticated attacker who reaches its web-services endpoint can send a crafted XML request with a malicious DTD, read arbitrary files off the gateway, or force it to make outbound requests (SSRF) into whatever internal network segments the gateway can reach — which by design is every rack it brokers console access to.

Who can reach it

Fully unauthenticated, remote — a crafted XML request to the CommandCenterWebServices endpoint is enough; no login required.

What to do

Software upgrade to CC-SG 8.0.0 or later. This is a single appliance (or small HA pair) rather than a per-rack device, so the upgrade footprint is small, but treat it as urgent — the gateway sits in front of console/KVM access to the entire managed fleet, so an unauthenticated file-read/SSRF bug there is a direct path toward every rack it manages.

References

Related entries

• Slurm (slurmdbd accounting database daemon): SQL injection into SlurmDBD gives an attacker read and write control ofCVE-2018-7033 · Slurm (slurmdbd accounting database daemon)Critical
• Kemp LoadMaster (LMOS): A flaw in session management lets a remote, unauthenticated attacker bypass the LoadMaster'sCVE-2018-9091 · Kemp LoadMaster (LMOS)Critical
• Slurm (slurmdbd, sacctmgr archive load): A second SQL injection path into SlurmDBD, this one through the 'sacctmgrCVE-2019-12838 · Slurm (slurmdbd, sacctmgr archive load)Critical
• HTCondor (condor_startd, condor_schedd, condor_shadow): One CVE covering four separate authentication failures theCVE-2019-18823 · HTCondor (condor_startd, condor_schedd, condor_shadow)Critical
• Lustre ptlrpc module (server-side client packet validation): A Lustre client can send a crafted RPC that overflows aCVE-2019-20427 · Lustre ptlrpc module (server-side client packet validation)Critical
• NetApp ONTAP Select Deploy administration utility (HTTP service): An unauthenticated attacker performs administrativeCVE-2019-5504 · NetApp ONTAP Select Deploy administration utility (HTTP service)Critical