Database/Firmware, BMC & network fabric
Facility power / DCIM as a class: PDUs, CRAC controllers, BMS and DCIM platforms run long-lived embedded firmware, sit
Impact
PDUs, CRAC controllers, BMS and DCIM platforms run long-lived embedded firmware, sit on flat facility networks, and are frequently outside the compute operator's change-control. An attacker with PDU control has a physical-availability weapon against a GPU cluster
Who can reach it
Network, facility LAN
What to do
Contractual and architectural: demand facility-network segmentation and a firmware SLA from the colo provider, and monitor the power plane independently. For a tenant in someone else's datacenter there is no patch you can apply yourself
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.