CVE-2019-16261
📋 TL;DR
This vulnerability allows unauthenticated attackers to send POST requests to Tripp Lite power distribution units, enabling them to change administrative passwords or shut off power to outlets. It affects Tripp Lite PDUMH15AT and SU750XL devices running vulnerable firmware versions. Organizations using these devices for critical infrastructure power management are at risk.
💻 Affected Systems
- Tripp Lite PDUMH15AT
- Tripp Lite SU750XL
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could shut off power to critical infrastructure, cause data center outages, or lock legitimate administrators out of devices by changing passwords.
Likely Case
Unauthorized power cycling of equipment leading to service disruption, or unauthorized configuration changes to power management devices.
If Mitigated
If devices are properly segmented and newer firmware is installed, impact is limited to isolated network segments with no internet exposure.
🎯 Exploit Status
Exploitation requires only sending POST requests to /Forms/ endpoints without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Newer firmware versions than those listed
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Download latest firmware from Tripp Lite support site. 2. Backup current configuration. 3. Upload and install new firmware via web interface. 4. Verify installation and restore configuration if needed.
🔧 Temporary Workarounds
Network segmentation
allIsolate PDU devices on separate VLAN with strict firewall rules
Access control restrictions
allImplement IP whitelisting for management interfaces
🧯 If You Can't Patch
- Segment devices on isolated network with no internet access
- Implement strict firewall rules to block all external access to PDU management interfaces
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH if available. Test if unauthenticated POST requests to /Forms/ endpoints are accepted.Check Version:
Check via web interface at device IP or use SNMP queries if configuredVerify Fix Applied:
Verify firmware version is newer than affected versions. Test that unauthenticated POST requests to /Forms/ endpoints are rejected.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated POST requests to /Forms/ endpoints
- Multiple failed authentication attempts followed by successful POST
Network Indicators:
- POST requests to PDU devices from unauthorized IPs
- Traffic to /Forms/ paths without authentication headers
SIEM Query:
source_ip=* AND dest_ip=PDU_IP AND http_method=POST AND uri_path="/Forms/*" AND NOT auth_token=*