Numerous DCIM systems vulnerable to cyberattacks

More than 20,000 data center infrastructure management systems, including UPS controllers, thermal and cooling management dashboards, transfer switches, and humidity controllers, are publicly exposed and could be exploited by threat actors in significant cyberattacks, BleepingComputer reports. Dashboard passwords have been extracted by Cyble researchers, who then leveraged them to obtain access to data center-stored database instances. Moreover, researchers discovered applications that enable complete remote access to data center assets, status report production, and system parameter configurations, with most of the applications leveraging outdated or default passwords that could be easily overridden. Public exposure of DCIMs could allow unauthorized modification of temperature and humidity thresholds, creation of false alarms, and voltage parameter configuration, which could have dangerous implications, according to researchers. Meanwhile, over 20,000 servers have been discovered by Internet Storm Center Handler Jan Kopriva to have exposed HPE Integrated Lights-Out management interfaces, which could be targeted in brute force attacks.