CVE-2016-9357: Path Traversal
An issue was discovered in certain legacy Eaton ePDUs -- the affected products are past end-of-life (EoL) and no longer supported: EAMxxx prior to June 30, 2015, EMAxxx prior to January 31, 2014, EAMAxx prior to January 31, 2014, EMAAxx prior to January 31, 2014, and ESWAxx prior to January 31, 2014. An unauthenticated attacker may be able to access configuration files with a specially crafted URL (Path Traversal).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9357?
The severity of CVE-2016-9357 is rated as high due to the presence of vulnerabilities in legacy Eaton ePDUs that are no longer supported.
How do I fix CVE-2016-9357?
To address CVE-2016-9357, users should replace the affected legacy Eaton ePDUs with supported models as they are past end-of-life.
Which Eaton ePDU products are affected by CVE-2016-9357?
CVE-2016-9357 affects Eaton ePDUs: EAMxxx prior to June 30, 2015, EMAxxx, EAMAxx, EMAAxx, and ESWAxx prior to January 31, 2014.
Are there updates available for products affected by CVE-2016-9357?
There are no updates available for the affected products since they are past end-of-life and no longer supported.
What should I do if I am using a legacy Eaton ePDU related to CVE-2016-9357?
If using a legacy Eaton ePDU affected by CVE-2016-9357, it is recommended to decommission these devices and replace them with newer, supported models.