Deep Sea Electronics DSE855 generator communications gateway v1.1.0-v1.1.26 (realtime.cgi): Incorrect access control

Impact

Incorrect access control on the realtime.cgi endpoint hands an attacker the admin panel and complete control of the device with no credentials. The DSE855 is the Ethernet gateway that fronts DSE generator and transfer-switch controllers, exposing them to the BMS and to remote monitoring. Control of it means control of the interface between the building's standby power and everything that watches it. Concretely: an attacker can reconfigure or disable the monitoring path so a genset failure goes unreported, and can reach the controller behind it. For a GPU datacenter this is the second half of the thermal problem - the cooling plant is the thing that stops when utility power drops and the generators do not pick up. A hall that loses chillers on a failed transfer is on the same minutes-to-thermal-shutdown clock as one whose CRAHs were commanded off, except now the UPS is draining under a 40-140 kW-per-rack load that it was probably not sized to ride through for long.

Who can reach it

Unauthenticated HTTP on the facility network - network-adjacent, no credentials. DSE855 units sit in generator yards, switchgear rooms and electrical closets on the building network. They are a classic 'installed by the generator contractor, never inventoried by IT' device, and because they exist to provide remote monitoring they are disproportionately likely to be reachable from outside the building through whatever remote-access arrangement the contractor set up.

What to do

Firmware update from Deep Sea Electronics for the DSE855. This is a small standalone gateway, so the flash itself is quick and does not require taking generators out of service - but it does need someone with physical or network access to the unit and a maintenance window on the monitoring path, and the generator contractor usually owns that relationship rather than the datacenter operator. Alongside patching: put generator and switchgear network devices on an isolated segment, remove any internet path, and specifically audit the generator contractor's remote-access arrangement, which is frequently a consumer-grade router or a cellular modem nobody in IT knows about. In a leased site the gensets and their gateways are the landlord's - ask who can reach them remotely.

References