ATEN PE8108 switched PDU: TENANT ISOLATION: a restricted (non-admin) user account on the PDU's web interface can control

Impact

TENANT ISOLATION: a restricted (non-admin) user account on the PDU's web interface can control outlets belonging to other users — meaning one tenant sharing this PDU with others can power-cycle or power-off outlets feeding another tenant's equipment, not just their own.

Who can reach it

Requires only a low-privileged, restricted user account on the PDU — no admin credentials needed to reach outlets outside the account's assigned scope.

What to do

Firmware upgrade from ATEN to a version that enforces per-outlet authorization correctly. Flash each PDU; since this is the power path for the racks it feeds, coordinate the maintenance window with anyone whose equipment is on that PDU.

References