APC Switched Rack PDU Authentication Bypass Vulnerability
BID:26636
Info
APC Switched Rack PDU Authentication Bypass Vulnerability
| Bugtraq ID: | 26636 |
| Class: | Access Validation Error |
| CVE: |
CVE-2007-6226 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 29 2007 12:00AM |
| Updated: | Mar 13 2008 02:21AM |
| Credit: | Gary Simat of Total Server Solutions LLC and Randy Kent of Sevaa Group Inc are credited with the discovery of this issue. |
| Vulnerable: |
APC rpdu 3.5.5 APC oas 3.5.6 |
| Not Vulnerable: | |
Discussion
APC Switched Rack PDU Authentication Bypass Vulnerability
APC Switched Rack PDUs (Power Distribution Units) are prone to an authentication-bypass vulnerability.
Attackers can exploit this issue to gain unauthorized access to affected devices. Successful exploits will allow attackers to control the power distribution to rack-mounted computer equipment. Attackers could leverage this to cause denial-of-service conditions and possibly physical damage.
The following firmware versions running on PDU part number AP9732 are vulnerable:
rpdu 3.5.5
aos 3.5.6
Other versions and devices may also be affected.
APC Switched Rack PDUs (Power Distribution Units) are prone to an authentication-bypass vulnerability.
Attackers can exploit this issue to gain unauthorized access to affected devices. Successful exploits will allow attackers to control the power distribution to rack-mounted computer equipment. Attackers could leverage this to cause denial-of-service conditions and possibly physical damage.
The following firmware versions running on PDU part number AP9732 are vulnerable:
rpdu 3.5.5
aos 3.5.6
Other versions and devices may also be affected.
Exploit / POC
APC Switched Rack PDU Authentication Bypass Vulnerability
Attackers can exploit this issue via a browser.
Attackers can exploit this issue via a browser.
Solution / Fix
APC Switched Rack PDU Authentication Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
APC Switched Rack PDU Authentication Bypass Vulnerability
References:
References: