CyberPower PowerPanel managed devices - shared device certificates: Every managed device uses an identical certificate

Impact

Every managed device uses an identical certificate derived from a hardcoded key, so any device can impersonate any other. An attacker who compromises one PDU in one rack can pose as every other device in the estate and feed the DCIM whatever telemetry they like - including telling it everything is fine while a hall overheats, or triggering automated responses that are themselves PHYSICAL actions.

Who can reach it

Anyone who obtains the key - which means anyone who obtains any single managed device, including a unit bought secondhand or pulled from an RMA pile.

What to do

Vendor firmware and platform upgrade that issues per-device certificates. Until then, the device identity layer provides no assurance and you should not build automated power actions on top of it. Note this also breaks the trust assumption in your decommissioning process: a device leaving your estate carries the fleet key with it.

References