OTPulse

Vertiv Liebert RDU101 and UNITY

Plan PatchCVSS 9.8ICS-CERT ICSA-25-140-10May 20, 2025
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Vertiv Liebert RDU101 versions 1.9.0.0 and earlier, and IS-UNITY versions 8.4.1.0 and earlier, contain vulnerabilities (CWE-288 insufficient authentication, CWE-121 stack-based buffer overflow) that allow remote code execution or denial of service. An unauthenticated attacker with network access can exploit these flaws to run arbitrary commands on the device or crash it. IS-UNITY is deployed in building management systems including HVAC control, power monitoring, and environmental management across data centers, hospitals, and critical infrastructure.

What this means
What could happen
An attacker with network access could execute arbitrary code on Liebert RDU101 or IS-UNITY devices, potentially disrupting HVAC or power monitoring/management operations at data centers, hospitals, or critical facilities. A denial-of-service attack could also disable these remote monitoring systems entirely.
Who's at risk
Data center operators, hospital facilities teams, and utilities using Vertiv Liebert RDU101 remote monitoring units or IS-UNITY building/power management systems should prioritize patching. These devices are commonly deployed in mission-critical environments where loss of monitoring or control could affect HVAC systems, power distribution, or infrastructure availability.
How it could be exploited
An attacker can send a specially crafted network request to an exposed RDU101 or IS-UNITY device without authentication. The vulnerability allows the attacker to run commands on the device or crash it, potentially gaining control over the environmental monitoring and management functions that regulate temperature, humidity, and power distribution.
Prerequisites
  • Network access to the RDU101 or IS-UNITY device on its management port (typically accessible from network)
  • No authentication or valid credentials required
remotely exploitableno authentication requiredlow complexitycritical severity (CVSS 9.8)affects facility management and monitoring systems
Exploitability
Unlikely to be exploited — EPSS score 0.9%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Liebert RDU101: <=1.9.0.0≤ 1.9.0.0v1.9.1.2_0000001
Liebert IS-UNITY: <=8.4.1.0≤ 8.4.1.0v8.4.3.1_00160
Remediation & Mitigation
0/5
Do now
0/1
WORKAROUNDRestrict network access to RDU101 and IS-UNITY management interfaces; allow connections only from authorized monitoring and management workstations
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Liebert RDU101 to firmware version 1.9.1.2_0000001 or later
HOTFIXUpdate IS-UNITY to firmware version 8.4.3.1_00160 or later
HARDENINGIf remote access to these devices is required, route traffic through a VPN gateway with strong authentication and keep the VPN software updated
Long-term hardening
0/1
HARDENINGPlace RDU101 and IS-UNITY devices on isolated network segments behind firewalls, blocking direct access from the internet and untrusted networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/0e374885-b1b2-41fb-8439-23abea59df39

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Vertiv Liebert RDU101 and UNITY | CVSS 9.8 - OTPulse