Deep Sea Electronics DSE855 generator communications gateway: Six unauthenticated flaws in one device: two stack-based

Impact

Six unauthenticated flaws in one device: two stack-based buffer overflows giving remote code execution, an infinite-loop DoS, a configuration-backup disclosure that leaks the device's stored settings and credentials, and missing authentication on both factory-reset and restart. The reset and restart issues deserve particular attention because they need no exploitation skill at all - a network-adjacent attacker simply asks the gateway to factory-reset itself, and the link between the generator controllers and the monitoring system is gone along with its configuration. Code execution gives persistence on a device sitting inside the electrical infrastructure segment. For an operator running GPU racks, the consequence is the same class as any standby-power monitoring failure: you find out your generators did not start when the hall goes dark and the cooling stops, and the accelerators cross thermal shutdown minutes later. The configuration disclosure additionally hands over credentials that are usually reused across the site's other DSE and BMS gear.

Who can reach it

Network-adjacent and unauthenticated for all six - no credentials required for any of them, including the destructive ones. The device's web service on the facility or electrical-infrastructure VLAN is the entire attack surface. As with the newer DSE855 issue, the generator contractor's remote-monitoring path is the most likely route in from outside.

What to do

Firmware update from Deep Sea Electronics. The unit is small and the flash is fast, but ownership is the friction: these are usually specified, installed and maintained by the generator vendor, not by the datacenter's own team, so the change has to go through that contract. Given that a factory reset can be triggered by anyone who can reach the device, an ACL restricting the gateway's web port to the monitoring server is a same-day control worth taking regardless of patch status. Keep an offline copy of the gateway configuration so a triggered factory reset is a ten-minute restore rather than a contractor callout.

References