Due to several vulnerabilities, attacks on data centers with the software CyberPower PowerPanel Enterprise and Dataprobe iBoot PDU are possible. In the worst case, attackers could compromise systems with malicious code.
Advertisement
Security researchers from Trellix warn of the vulnerabilities in a report. PowerPanel Enterprise is used for energy monitoring of devices. The software iBoot PDU takes care of the power distribution and control. Admins can use this to detect power outages and initiate countermeasures.
Cut out data centers
The most dangerous is a vulnerability (CVE-2023-3259 “critical”) in iBoot PDU. If an attacker manipulates the IP address field in the iBootPduSiteAuth cookie, he can bypass the authentication and perform actions with admin rights. It is also possible to export user data or even manipulate the power supply.
The majority of the remaining vulnerabilities are rated “high” threat level. At these points, attackers can view hard-coded access data or execute malicious code, among other things.
The security researchers outline failures of data centers due to a cut in power supply as the effects of the attacks. Furthermore, the distribution of malware on a large scale is conceivable. In addition, attackers can use backdoors to establish themselves in systems and thus spy.
Patch now!
Advertisement
Admins should ensure that the versions iBoot PDU 1.44.08042023 and PowerPanel Enterprise 2.6.9 protected against the attacks described are installed. In addition, systems should not be accessible directly from the Internet, if possible, in order to reduce the attack surface. In addition, strong passwords should be used for access.
(of the)
Go to home page
#Vulnerabilities #Attackers #place #backdoors #data #centers
