Eaton UPS 9PX 8000 SP web interface: The device's own web page contains the user password in cleartext in the page

CVE-2018-9279Firmware, BMC & network fabriccurated

Impact

The device's own web page contains the user password in cleartext in the page source. Anyone who gets a single authenticated view - or a screenshot, or a saved page in a support ticket - has the credential. The companion issue CVE-2018-9280 does the same for the SNMPv3 read and write user passwords, which is worse, because the SNMP write community is a control channel.

Who can reach it

Anyone who can load the UPS web interface, or who obtains a saved copy of the page.

What to do

Firmware update where available. Rotate the UPS and SNMPv3 credentials, and specifically rotate the SNMP write credential - and then ask whether SNMP write needs to be enabled at all, because on most UPS deployments it does not.

References

https://www.bishopfox.com/news/2018/10/eaton-ups-9px-8000-sp-multiple-vulnerabilities/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.