Eaton Tripp Lite series PADM firmware, session management interface: An authenticated administrator can break out

Impact

An authenticated administrator can break out of the restricted shell and run arbitrary commands on the PDU. That turns a device you thought was an appliance into a persistent Linux foothold sitting on your out-of-band network, below every server it powers and outside any endpoint tooling you run.

Who can reach it

Requires administrator credentials on the PDU - which, given the companion authentication bypass, an unauthenticated attacker can obtain first. Chain the two and this is unauthenticated remote code execution on rack power infrastructure.

What to do

PADM firmware update, or hardware replacement for EOL SKUs. Rotate PDU admin credentials, which are very commonly shared fleet-wide from the original commissioning.

References