{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "PX3 PDU",
          "vendor": "Raritan",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in the\nRaritan PX3 PDU G4, firmware version 4.3.14, the intelligent rack power\ndistribution unit from Raritan, a Legrand company (United States). A\nlow-privilege authenticated session converts one diagnostics request into\noperating-system command execution in the product\u0027s web-service context,\nbecause the hostname validation that is supposed to gate the ping and\ntraceroute commands produces the correct rejection verdict and the caller then\nexecutes on it anyway.\n\nType and root cause. CWE-78, OS command injection, with CWE-20 co-equal,\nin the diagnostics service of /lib/libisys.so.1.0. The firmware is an aarch64\nembedded Linux image whose web tier is a custom 1.8 MB C++ daemon, /bin/httpd,\nbuilt on an IDL-RPC framework: an authentication subsystem the binary refers\nto as pp::aaa, a JSON-RPC name service, and seventy-five service namespaces,\nall behind per-method authentication. The two diagnostics implementations,\nisys::net::diag::ping at 0x5a988 and isys::net::diag::traceRoute at 0x5ab64,\ndo not perform network operations themselves: they assemble shell command\nstrings from the operator-supplied hostname and execute them through /bin/sh,\nvia pp::BackgroundCommand::open(bgCmd, \"/bin/sh\", argv) at 0x36170, reached\nthrough runShellCommandAndGetResults() at 0x36094, which logs the command it\nis about to run. The templates are ping -c \u003ccount\u003e -W \u003ctimeout\u003e \u003cHOST\u003e 2\u003e\u00261\nand traceroute -w \u003ctimeout\u003e -m 30 \u003cHOST\u003e 2\u003e\u00261, with ping6 and traceroute6\nvariants; the neighbouring string table carries \"ping\", \"ping6\", \"traceroute\",\n\"traceroute6\", \"2\u003e\u00261\" and the source file name \"DiagnosticsImpl.cpp\".\n\nThe defect is a returned verdict consumed with the wrong comparison. The\nvalidation function, validateAndResolveHostName() at 0x5a3f4, is not a stub:\nit walks the hostname character by character, explicitly rejects the percent\nsign and every character above the ASCII colon, cross-checks that the host\nresolves through the resolver service, and returns one constant, three, on\nevery rejection path - the rejection block converges at the load of that\nconstant and returns at 0x5a54c. Both consumers evaluate the verdict with an\nunsigned strictly-greater branch: a return of three is not strictly greater\nthan three, so it falls through, and the rejected hostname is spliced into the\nshell template verbatim. The result is an injection whose success condition is\nthe validator working exactly as designed: a semicolon is caught by the\ncharacter loop, a dollar or parenthesis survives the loop but fails\nresolution, and all of them - caught or unresolved - flow into the command\ntemplate. A host value of 1.1.1.1;id\u003e/tmp/marker;# keeps the ping segment\nsyntactically complete, runs the injected statement as a second shell\nstatement, and the trailing hash comments out the template\u0027s 2\u003e\u00261 suffix; the\nsubshell form and a newline-separated form ride the same rejection path; the\ntraceroute template arms the second entry point identically. The image\ncontains a strict fully-qualified-hostname validator in libnetwork.so, but\nthe web daemon does not import it and the diagnostics library neither links\nnor loads it on this code path.\n\nThe request that reaches the sink looks like this, transmitted as one JSON\nbody over the authenticated RPC channel:\n\n```\n{\n  \"jsonrpc\": \"2.0\",\n  \"method\": \"net.Diagnostics.ping\",\n  \"params\": {\n    \"host\": \"1.1.1.1;id\u003e/tmp/marker;#\",\n    \"count\": 1,\n    \"timeout\": 1\n  },\n  \"id\": 2\n}\n```\n\nThe same attacker string rides the hostname argument of the corresponding CLI\ncommands. The 2\u003e\u00261 merge suffix is an amplifier the attacker inherits for\nfree: whatever the injected command prints on either stream is captured by the\nsame mechanism that returns ping output, so the response channel doubles as\nthe command-output channel and no out-of-band exfiltration is needed.\n\nReach and privileges. The web methods sit behind the framework\u0027s per-method\nauthentication and no bypass of that boundary was measured. The load-bearing\nprivilege artifact is the shipped CLI configuration, /etc/clish/netdiag.xml:\nping and traceroute are defined with no access attribute - available to every\nauthenticated CLI user in this framework\u0027s grammar - while the neighbouring\nnetstat command carries access=\"admin\". The vendor\u0027s own artifact therefore\ndocuments that these two functions were deliberately placed in the\nall-authenticated-users class, presumably on the theory that a ping is\nharmless. On a rack PDU, management is a network service at a datacenter\u0027s\nsoftest point, and the finding\u0027s effective audience is every monitoring\naccount, operations automation role and integration credential granted \"just\nto poll\".\n\nSeverity. The published score is 8.8 High,\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: ISS = 1 - (1 - 0.56) x (1 -\n0.56) x (1 - 0.56) = 0.914816, impact = 6.42 x 0.914816 = 5.869119,\nexploitability = 8.22 x 0.85 x 0.77 x 0.62 x 0.85 = 2.835255, base =\n5.869119 + 2.835255 = 8.704374, rounded up to 8.8. A PR:N reading of 9.8\nCritical (impact 5.869119 plus exploitability 3.887043, total 9.756162) is\nrejected: no authentication bypass was measured. Two conditional readings are\npublished as explicitly labelled conditionals and never as the headline. The\nfirst applies where a deployment still carries the factory default\nadministrative credential pair recorded in the image\u0027s configuration default\narea for first-boot access: the same PR:N vector computes to 9.8 Critical for\nthe chain of that adjacent weakness plus this injection, and a changed\ncredential removes it; the default pair is disclosed as a separate weakness\nand is not folded into the published vector. The second applies only to\ndeployments in which no low-privilege account is provisioned and every caller\nholds administrator privileges: the PR:H vector computes to 7.2 High\n(exploitability 1.234708 plus 5.869119, total 7.103826), and it is not the\nheadline because the vendor\u0027s own shipped CLI artifact grants diagnostics to\nall authenticated users.\n\nVerification method, and its boundary. Every static claim is measured from the\nfirmware image at instruction level: the templates, the character loop, the\nconverging rejection blocks, the consumers\u0027 compare-and-branch sequences, the\nshell open, and the two import facts. The dynamic layer is a command-level\nreplication of the recovered sink semantics on an isolated research host: the\nexact reconstructed templates were executed through a shell under the\nsemicolon, subshell and traceroute injection shapes, and each produced the\nmarker command\u0027s output, while a metacharacter-free control produced nothing\nand the marker path was confirmed absent afterwards. What was not done: no\nend-to-end exploitation through the management interface of a physical unit.\nNo physical unit was available, and full-system emulation was blocked by the\nmanagement daemon\u0027s dependency on the configuration daemon and the flash\nstorage layer, which an image-only extraction does not provide. Appliance-side\nexecution identity was therefore not measured at runtime and is not claimed;\nthe replication\u0027s shell ran under the research host\u0027s privileged account,\nwhich is a property of the research environment, and the published claims are\nwritten against the web service\u0027s account, whichever that is.\n\nImpact. One authenticated request converts into command execution in the\nprocess context of the web management daemon, with command output returned\nthrough the same response channel. The service\u0027s read reach includes the\nproduct\u0027s configuration and state stores, so configuration data, recorded\ncredentials and network information can be exfiltrated in the same channel\nthat ping output arrives in. Both methods accept repeated calls with fresh\nhostnames, so staging, reading results and cleanup are one request each, and\nno persistence inside the product is needed. On a power distribution product,\navailability is the physical machine state: the injected command executes in\nthe daemon that hosts the outlet control surface, so the ability to cycle\noutlet power, and thereby hard-stop, every machine fed by the unit, follows\nfrom the product\u0027s own function. That consequence is a labelled inference.\nsink level was measured. Detection is poor by construction: the triggering\nrequest is a legitimate diagnostics call that the product logs as the\nassembled shell command, and the strongest available signal is shell-command\nlog review for the two templates.\n\nRemediation, in the order that removes the class: perform ping and traceroute\nwithout a shell, through their library or raw-socket interfaces or an\nargv-array spawn, which removes the CWE-78 class from this handler entirely;\ncorrect the verdict consumption - accept only the documented success returns\nand reject everything else - as a one-line containment that can ship\nimmediately; centralize hostname admission for both entry channels on a\nliteral-or-strict-name allow-list that runs before any command text is\nassembled, using the strict validator already present in the image; audit\nevery other consumer of the shared validation function for the same\nstrictly-greater consumption of the rejection constant; remove the factory\ndefault credential and force a first-login change, which closes the\nconditional unauthenticated chain; add injection regression suites for both\nchannels covering the full character-class table; and make the shell-template\nlog line an alertable event. Operator measures until firmware is fixed: change\nthe factory default immediately, restrict management access to the operations\nnetwork, prefer monitoring roles that need no diagnostics, and alert on\ndiagnostics shell lines whose host segment is not a literal address or strict\nname.\n\nProof of concept. The published tool is a standard-library-only Python 3\nclient that drives the entry path against an explicit target with explicit\ncredentials or a pre-established session token, a configurable command and\nexplicit timeouts; it attempts the two candidate session-establishment routes\nobserved in this framework generation\u0027s front ends and degrades to a supplied\ntoken, and it embeds no addresses, credentials or state of the verification\nenvironment. Safety rails: loopback default, no persistence steps, one\nnon-destructive marker command by default, and no configuration change beyond\nwhat the described request performs. Use it only against systems you own or\nare authorised to test.\n\nThe vendor\u0027s parent company product security team, whose signed RFC 9116\ncontact file on the parent\u0027s primary web host names the intake mailbox used,\nwas notified through that documented security mailbox, which is the only\nchannel used; no security intake of the router brand itself exists, no\npre-publication intake form was submitted, and no individual was addressed by\nname. This disclosure is unconditional: the research is published, no\npermission was asked for, no embargo was requested, nothing is withheld\npending a reply, and remediation questions are answered at no cost. No\nvulnerability identifier has been assigned to this finding.\n\nFull technical analysis and the reproducible proof of concept, published\nunconditionally:\n  https://0day-rubbish.com/blog/raritan-px3-pdu-g4-diag-ping-traceroute-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:04Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/54"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/54"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/raritan-px3-pdu-g4-diag-ping-traceroute-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/54"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0506",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/54",
            "automated": true,
            "contentSha256": "8ab1603aae2c30145f46927eb66bc545f561770746543a7428d7f853ae26dd52",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/54",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-27T16:39:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:04Z",
    "dateUpdated": "2026-11-02T07:30:04Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0506"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}