CVE-2019-16261 - Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet

Back Back to CVE browser

CRITICAL

Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet

Published Sep 12, 2019

9.1

CRITICAL

CVSS 3.1

EPSS 2.76%

Description

Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this vulnerability, had already been released before this vulnerability report about 12.04.0053.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

Link	Providers	Tags
http://seclists.org/fulldisclosure/2025/Mar/1
https://blog.korelogic.com/blog/2019/08/19/unpatched_fringe_infrastructure_bits		ExploitThird Party Advisory
https://gist.github.com/Shlucus/ab762d6b148f2d2d046c956526a80ddc