Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)

Full Disclosure ()1 · 1 read
Read at seclists.org
Part of a story covered by 5 sourcesFive command-injection flaws disclosed in network and enterprise gearMerged summary & timeline
AI summary · grok-4.7Summaries by Vani AI

0day Rubbish disclosed authenticated root command execution in Server Technology PRO3X PDUs on firmware 030600.

The 0day Rubbish Research Team publicly disclosed a vulnerability in Server Technology (Legrand) PRO3X intelligent rack PDUs. Firmware spdu-pro3x-030600 build 46640 lets an authenticated attacker override the port_mux listener and run commands as root (CWE-78, CWE-269). A separate hard-coded factory credential is also reported (CWE-798). The post cites no CVE and does not say the flaw is being exploited.

Key facts
  • Authenticated port_mux override yields root command execution on PRO3X PDUs.
  • Affects firmware spdu-pro3x-030600 build 46640 on ARM uClibc Linux.
  • Researchers also report a separate hard-coded factory credential (CWE-798).
  • Issues mapped to CWE-78 and CWE-269; no CVE or observed exploitation.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
server-technologylegrandpdurcecwe-78hardcoded-credentialsfull-disclosure
Vendors
Server TechnologyLegrand
Products
PRO3X
Organizations
0day Rubbish Research Team

From the original article

Posted by disclosure via Fulldisclosure on Sep 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Server Technology (Legrand group) PRO3X series intelligent rack PDUs, firmware spdu-pro3x-030600 build 46640 (ARM 32-bit uClibc Linux). Type: authenticated listener program override leading to root command execution (CWE-78, CWE-269; a separate hard-coded factory credential is reported as CWE-798).

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.