Authentication bypass flaw reported in Packet Power Infrastructure Monitoring devices
Take action: If you use Packet Power EMX or EG devices make sure they are isolated from the internet and accesible only fro trusted networks. Then plan a quick update them to version 4.1.0 or later to fix a critical authentication bypass that lets attackers take complete control of your power monitoring systems without any credentials.
Learn More
Packet Power's EMX and EG industrial monitoring systems are reported to be vulerable to authentication bypass that allows unauthorized attackers to gain complete control over power monitoring and management functions.
The flaw is tracked as CVE-2025-8284 (CVSS score 9.3)- Missing Authentication for Critical Function (CVSS score 9.3): No authentication controls in the web interface that allows unauthorized remote attackers to gain full access to device monitoring and control functions.
The vulnerability affects all versions of Packet Power's EMX (Energy Management System) and EG (Ethernet Gateway) products prior to version 4.1.0,
Security researchers Anthony Rose and Jacob Krasnov of BC Security discovered and reported the authentication bypass vulnerability to CISA.
Packet Power has released security updates in version 4.1.0 and later that fixed the authentication bypass vulnerability. The company strongly recommends that organizations immediately update all EMX and EG devices to version 4.1.0 or later. Additionally, Packet Power advises isolating devices whenever possible and implementing network-level access controls to prevent unauthorized access.
