Database/Firmware, BMC & network fabric
Rittal PDU-3C002DEC rack PDU firmware (through 5.17.10): A backdoor root account in the PDU firmware. Not a weak
Impact
A backdoor root account in the PDU firmware. Not a weak default that an operator could change - an undocumented account shipped in the image. Anyone who knows it owns the device that switches power to the rack, and nothing in your provisioning process would ever have noticed it.
Who can reach it
Network access to the PDU management interface, with credentials that are public knowledge once the advisory is out.
What to do
Firmware update to a build that removes the account. This is a per-PDU flash, two per rack, and the update must be verified rather than assumed - check that the account is actually gone on a sample. Treat undocumented accounts as a procurement question going forward: require vendors to attest that no non-configurable accounts exist before you buy a PDU SKU at fleet scale.
References
Related entries
- Rittal PDU-3C002DEC rack PDU firmware (through 5.17.10): Least-privilege violation: low-privilege users on the PDU getCVE-2020-11956 · Rittal PDU-3C002DEC rack PDU firmware (through 5.17.10)Critical
- Dell iDRAC9: Stack-based buffer overflow via crafted remote input — pre-auth code execution on the BMCCVE-2020-5344 · Dell iDRAC9Critical
- APC Easy UPS On-Line Software (SFAPV9601) FileUploadServlet: Path traversal in a file upload servlet allows writingCVE-2020-7521 · APC Easy UPS On-Line Software (SFAPV9601) FileUploadServletCritical
- Arista EOS (eAPI certificate auth): Certificate-based eAPI authentication skips credential re-evaluationCVE-2021-28503 · Arista EOS (eAPI certificate auth)Critical
- HPE iLO Amplifier Pack (unauthenticated directory traversal): Unauthenticated directory traversal on the iLO AmplifierCVE-2021-29212 · HPE iLO Amplifier Pack (unauthenticated directory traversal)Critical
- Insyde InsydeH2O (AtaLegacySmm SMM driver): The SMI handler in the legacy ATA driver does not validate the CommBufferCVE-2021-41842 · Insyde InsydeH2O (AtaLegacySmm SMM driver)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.