Couple of vulnerabilities I found from #Eaton Rack PDU G4:
ETN-VA-2025-1002: Multiple vulnerabilities detected in Eaton G4 PDU
#CVE_2025_48393
CVSS v3.1 Base Score – 5.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack.
#CVE_2025_48394
CVSS v3.1 Base Score – 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
An attacker with authenticated and privileged access could modify the contents of a nonsensitive file by traversing the path in the limited shell of the CLI.
These vulnerabilities are fixed in firmware version 3.5.0 and later. It is recommended to upgrade the device firmware as soon as possible.
#infosec #cybersecurity