Tripp Lite PDUMH15AT / SU750XL PDU: The PDU accepts unauthenticated POST requests to its /Forms/ endpoints, which can

CVSS 9.1CVE-2019-16261Firmware, BMC & network fabriccurated

Impact

The PDU accepts unauthenticated POST requests to its /Forms/ endpoints, which can be used to change the manager or admin password, or directly shut off power to an outlet. Anyone who can reach the PDU's web interface can cut power to whatever rack that outlet feeds, with no login at all.

Who can reach it

Fully remote and unauthenticated — a crafted POST request to the /Forms/ directory is all that's needed to flip an outlet or take over the admin account.

What to do

Software/firmware upgrade — Tripp Lite (now Eaton) shipped a fixed release after this was reported; confirm every deployed unit is past 12.04.0053 (PDUMH15AT) / 12.04.0052 (SU750XL). Flash each PDU; this directly powers a rack, so schedule around a window where a brief power-monitoring interruption is acceptable, and audit for units still on vulnerable firmware since these are frequently forgotten 'fringe' infrastructure.

References

https://blog.korelogic.com/blog/2019/08/19/unpatched_fringe_infrastructure_bits

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.