Vertiv Liebert IS-UNITY-DP and RDU101 UPS network cards: two critical vulnerabilities reported by Claroty Team82 (CISA advisory May 2025; Team82 attack write-up June 2026)
CVSS 9.8 x2 (CVE-2025-46412, CVE-2025-41426)observed
| Value kind | observed — Reported measurements, counts, and specifications keep the precision and scope stated by their source; an exact specification is not treated as a range. |
|---|---|
| Scope | Published and patched; chaining gives unauthenticated remote code execution on the UPS card. CISA scores both flaws CVSS v3.1 9.8 and CVSS v4 9.3. Named data-center equipment, not generic BMS. |
| As of | 2025-05-20 (CISA advisory); Team82 write-up 2026-06-09 |
| Source | CISA ICSA-25-140-10 (2025-05-20; fixes RDU101 v1.9.1.2_0000001, IS-UNITY v8.4.3.1_00160); Claroty Team82, "Attacking UPS Network Cards to Take Down Data Centers" (2026-06-09 write-up). · Research post CVE summary and remediation section. |
| Review | checking…review by 2027-03-08 · standard cadence |
| Recorded changes | last 2026-10-19 |
| Claim id | p2b-11-10-vertiv-ups-card-cves |
Where the guide uses it
Not quoted in a chapter yet; it is kept in the curated register.
← Full numbers register — every date-stamped figure in the guide, with revision history.