Database/Firmware, BMC & network fabric
Tripp Lite PDUMH15AT / SU750XL PDU: TENANT ISOLATION: the PDU accepts unauthenticated POST requests to its /Forms/
Impact
TENANT ISOLATION: the PDU accepts unauthenticated POST requests to its /Forms/ endpoints, which can be used to change the manager or admin password, or directly shut off power to an outlet. Anyone who can reach the PDU's web interface can cut power to whatever rack that outlet feeds, with no login at all.
Who can reach it
Fully remote and unauthenticated — a crafted POST request to the /Forms/ directory is all that's needed to flip an outlet or take over the admin account.
What to do
Software/firmware upgrade — Tripp Lite (now Eaton) shipped a fixed release after this was reported; confirm every deployed unit is past 12.04.0053 (PDUMH15AT) / 12.04.0052 (SU750XL). Flash each PDU; this directly powers a rack, so schedule around a window where a brief power-monitoring interruption is acceptable, and audit for units still on vulnerable firmware since these are frequently forgotten 'fringe' infrastructure.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.