Optergy Proton / Enterprise building management platform: A backdoor console giving remote root code execution

Impact

A backdoor console giving remote root code execution, alongside hard-coded credentials, CSRF, and authenticated file upload that also runs as root. Optergy is a full BMS platform - it aggregates HVAC, metering and often access control for a site - so root on it is root over the facility's control surface and its credential store. An attacker gets to command cooling equipment directly, alter schedules and setpoints, silence alarms, and read out whatever downstream device passwords the platform holds. For a GPU operator the physical consequence is the familiar one: cooling commanded away from a hall of 40 kW+ racks means thermal shutdown in minutes, lost checkpoints and thermal-cycling damage. The backdoor is the part that should decide the response - a deliberate hidden access path means you cannot reason about who has been in the system historically.

Who can reach it

Remote, unauthenticated, over the platform's web interface on the facility network. Optergy deployments are frequently published for remote access because the product is sold on browser-based management, so internet exposure is a realistic assumption rather than an edge case. Hard-coded credentials mean even a 'secured' instance is open to anyone who read the advisory.

What to do

Vendor firmware/software update - a platform upgrade rather than controller flashing, so no cooling downtime, but it requires the integrator and a version that removes the backdoor console. Given a deliberate backdoor was present, patching alone is not sufficient: rebuild or re-image the platform, rotate every credential it ever stored, and rotate credentials on every downstream device it integrated. Then remove all internet exposure and put it behind a jump host with MFA. If the platform is under an integrator's remote-support contract, audit that path specifically.

References