Rittal PDU-3C002DEC rack PDU firmware (through 5.17.10): Least-privilege violation: low-privilege users on the PDU get

Impact

Least-privilege violation: low-privilege users on the PDU get far more capability than the role implies, up to and including control of the device. Read-only monitoring accounts handed to a DCIM system or an NOC contractor become power control.

Who can reach it

Any authenticated user on the PDU, including monitoring accounts.

What to do

Firmware update per PDU. Audit third-party accounts on the power estate at the same time - the monitoring integration is usually how the low-privilege credential got into someone else's hands.

References