TL;DR

A new vulnerability (ZDI-26-129) allows attackers to bypass authentication on Socomec DIRIS A-40 power monitoring devices without needing credentials.

What happened

['Authentication bypass on Socomec DIRIS A-40 HTTP API', 'Network-adjacent attackers can exploit the vulnerability']

Why it matters for ops

['Impact on network security due to unauthorized access', 'Risk of data theft or disruption']

Mitigation

  • Upgrade to a patched version of the software if available
  • Implement network segmentation and access controls
  • Monitor for suspicious activity on power monitoring devices

Action items

  • Review security configurations and implement mitigations
  • Contact Socomec for updates or patches

Detection IOCs

  • Unusual HTTP requests targeting the Socomec DIRIS A-40 API endpoints
  • Attempts to bypass authentication mechanisms

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-129/