CVE-2025-46412CWE-288

Vertiv Liebert RDU101 and UNITY Authentication Bypass Using an Alternate Path or Channel

Critical · published May 21, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

🔥 A critical flaw allows attackers to slip past authentication on Vertiv products – think of it as a bouncer letting in anyone who just whispers a password! 🤯 It’s like a hotel with a check-in desk that doesn’t verify guest IDs – anyone could walk in and access the rooms without any scrutiny. This vulnerability leaves webserver functions exposed, making it surprisingly easy for malicious actors to bypass security features. An attacker could waltz right in and perform any action without authentication, potentially compromising sensitive data or controlling the device entirely. In a scenario that could lead to data breaches or unauthorized access, this flaw is absolutely devastating and needs immediate attention!

Put simply

It’s like a hotel with a check-in desk that doesn’t verify guest IDs – anyone could walk in and access the rooms without any scrutiny. This vulnerability leaves webserver functions exposed, making it surprisingly easy for malicious actors to bypass security features. This vulnerability arises from improper protection of webserver functions in affected Vertiv products, allowing attackers to bypass authentication mechanisms and execute unauthorized operations.

What to do

An attacker could waltz right in and perform any action without authentication, potentially compromising sensitive data or controlling the device entirely. In a scenario that could lead to data breaches or unauthorized access, this flaw is absolutely devastating and needs immediate attention! To safeguard your systems, patch affected Vertiv products immediately and ensure they are updated to the latest version. Additionally, review and strengthen your authentication mechanisms to prevent unauthorized access. You've got this! With prompt action, you'll secure your systems and maintain your hero status in the security realm! 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00584 · 47.2th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2025-05-21T19:20Z
EPSS history
Timeline
  • 21 MAY 19:20Z
    Vertiv Liebert RDU101 and UNITY Authentication Bypass Using an Alternate Path or Channel
    cvelistv5