EnerSys AMPA Command Injection Vulnerability Leading to Privileged Remote Shell Access

A command injection vulnerability has been identified in EnerSys AMPA versions through 22.09, allowing unauthorized remote shell access with elevated privileges. This issue arises from the web interface, where improper input validation enables the execution of arbitrary commands on the affected unit.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device, with the executed code running in a privileged context.

Remediation

Users are advised to upgrade to EnerSys XM3.1 firmware version 1.07.00 or 1.10.01, and to upgrade SMG-HP and ADOM firmware to version 02.02.00 or 02.07.01. After updating, contact EnerSys for indicators of compromise and tactics, techniques, and procedures related to this vulnerability. Additionally, it is recommended to harden network configurations by isolating management interfaces and restricting access via firewall to trusted IPs.