Vertiv Liebert RDU101 (<=1.9.0.0) and Liebert IS-UNITY (<=8.4.1.0) communication cards: Authentication bypass plus

Impact

Authentication bypass plus a stack-based buffer overflow giving code execution on the card that sits inside Liebert cooling and power equipment across most of the datacenter industry. This is the worst shape a facility bug can take: an unauthenticated attacker on the facility network gets a persistent foothold on a device physically wired into thermal control, and from there can command the attached unit, spoof telemetry upward to the DCIM/BMS so dashboards stay green, and pivot laterally to every other card on the same VLAN. Applied against the cooling serving a GPU hall this is a fleet-wide availability kill and a hardware-damage risk, not an IT incident. Because the card also relays alarms, the same access lets an attacker blind the operator during the event. For a multi-tenant operator it is also a tenant-handoff problem: a card compromised under one tenant's occupancy stays compromised across the next tenant, because nobody re-flashes communication cards between customers.

Who can reach it

Unauthenticated, network-reachable, low complexity - CISA rates it exploitable remotely. The realistic exposure is the facility/BMS VLAN. RDU101 and IS-UNITY cards are also routinely reachable from the DCIM collector and, in far too many sites, from a vendor remote-support VPN concentrator that the mechanical contractor owns. Shodan-class internet exposure of Liebert cards is a recurring finding, so check whether yours are NAT'd out for 'remote monitoring'.

What to do

Patchable, and this one is worth the window: update RDU101 to v1.9.1.2_0000001 and IS-UNITY to v8.4.3.1_00160. The card firmware update does not require draining the cooling unit, but it does require the card to be reachable and briefly offline, so schedule it as a monitoring outage rather than a cooling outage - budget a per-card touch across the whole fleet, which for a large hall is dozens of cards and a real technician-day cost. Alongside the patch, segment: cards on a dedicated VLAN, no route to tenant or corporate networks, no inbound from the internet, and inventory every Liebert card by firmware version so you can prove the fleet is clean. Leased colo: this is the landlord's card in the landlord's unit - send them the CISA advisory ID and require written confirmation of the firmware level.

References