Eaton UPS 9PX 8000 SP administration panel: CSRF on the change-password function plus reflected XSS: an attacker forces

Impact

CSRF on the change-password function plus reflected XSS: an attacker forces a silent password change on the UPS admin account and takes over the device. Once they hold the UPS admin account they control shutdown behaviour and output for whatever the unit feeds - a PHYSICAL outcome from a web bug.

Who can reach it

Requires a logged-in UPS administrator to load an attacker-controlled page.

What to do

Firmware update on the UPS network card where available. On units this age, availability of a fix is not guaranteed - if none exists, the mitigation is a dedicated management VLAN, no browser access to UPS interfaces from general-purpose workstations, and disabling the web interface if the unit can be managed another way.

References