Raritan PX3 PDU G4 firmware 4.3.14 has command injection
First merged summary.
Researchers disclosed an authenticated command-injection flaw in Raritan PX3 PDU G4 firmware 4.3.14; no fix is stated.
0day Rubbish Research Team publicly disclosed a command-injection flaw in the Raritan PX3 PDU G4, firmware 4.3.14. A low-privilege authenticated session can turn a ping or traceroute diagnostics request into operating-system command execution in the web-service context. The team attributes the issue to an inverted hostname-validation return check and rates it 8.8. Raritan is identified as a Legrand company. No fix is stated.
- Affected product is Raritan PX3 PDU G4 firmware 4.3.14.
- Ping and traceroute diagnostics are the injection points.
- A low-privilege authenticated session can trigger the flaw.
- Hostname validation is described as an inverted return check.
- The team rates the issue 8.8; no fix is stated.
Timeline
dated events in the reporting · oldest first- Oct 29, 2026Researchers publicly disclose the PX3 PDU command injection. · Full Disclosure
What each outlet adds
beyond the shared facts- Full DisclosureNames firmware, diagnostics injection points, inverted check, and 8.8 rating.
- Products
- PX3 PDURAX120Nighthawk AX12
- Organizations
- Legrand0day Rubbish Research Team
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · 2d ago
Full DisclosureFirst report
Raritan PX3 PDU 4.3.14 diagnostics allow command injection
A low-privilege authenticated diagnostics request can run OS commands in the web-service context.
- · 2d ago
NETGEAR RAX120 V1.2.5.18 SOAP InstallApp command injection disclosed
An authenticated request can reach OS command execution in the router's root-configured web stack.