ATEN PE8108 switched PDU: A restricted (non-admin) user account on the PDU's web interface can control outlets

Impact

A restricted (non-admin) user account on the PDU's web interface can control outlets belonging to other users — meaning one tenant sharing this PDU with others can power-cycle or power-off outlets feeding another tenant's equipment, not just their own.

Who can reach it

Requires only a low-privileged, restricted user account on the PDU — no admin credentials needed to reach outlets outside the account's assigned scope.

What to do

Firmware upgrade from ATEN to a version that enforces per-outlet authorization correctly. Flash each PDU; since this is the power path for the racks it feeds, coordinate the maintenance window with anyone whose equipment is on that PDU.

References

Related entries

• AMI MegaRAC SPx (IPMI handler): Buffer overflow in the BMC's IPMI message handler leading to code executionCVE-2023-34336 · AMI MegaRAC SPx (IPMI handler)High
• Lenovo XClarity Controller (XCC) - user account API: A read-only XCC user can change any other user's password throughCVE-2023-4606 · Lenovo XClarity Controller (XCC) - user account APIHigh
• OpenBMC phosphor-net-ipmid: unauthenticated RAKP handler leaves default key, allowing BMC login bypassCVE-2026-16141 · OpenBMC phosphor-net-ipmid (IPMI 2.0 RAKP session authentication)High
• IBM PowerVM partition firmware: unauthenticated attacker on the boot VLAN can substitute a netboot imageCVE-2026-17414 · IBM PowerVM partition firmware (network boot)High
• IBM Power Systems Firmware: BMC/FSP root can write arbitrary hardware control registers and take the hostCVE-2026-17429 · IBM Power Systems Firmware (BMC/FSP-to-host register interface)High
• Dell SmartFabric Manager: insufficient verification of data authenticity allows privilege elevationCVE-2026-26950 · Dell SmartFabric Manager (data authenticity verification)High