A critical authentication bypass in Packet Power monitoring interfaces allows unauthorized remote attackers to manipulate power control systems.

The web interface for these devices lacks mandatory authentication, allowing an unauthenticated attacker to interact with the device’s administrative functions directly.

Successful exploitation allows an attacker to gain full control over power monitoring and control interfaces, which could lead to unauthorized system configuration changes or service disruptions. Given the CVSS score of 9.8, the business impact is severe, as it directly compromises the integrity and availability of critical infrastructure monitoring.

Immediate Action: Update all affected Packet Power EMX and EG devices to firmware version 4.1.0 or later immediately.

Proactive Monitoring: Audit logs for unauthorized access patterns or configuration changes occurring from unknown IP addresses.

Compensating Controls: Isolate affected devices within a secure management VLAN and restrict access to the web interface to authorized personnel only via a VPN or gateway.

Public Exploit Available: Unknown

Applying the vendor-provided firmware update is the only effective way to remediate this vulnerability. Organizations using these power monitoring solutions should prioritize this update to prevent unauthorized access to their power management infrastructure.