Introduction
In Packet Power EMX and EG devices, a single missing authentication check in the web interface exposes every monitoring and control function to anyone with network access. The vulnerability is tracked as CVE-2025-8284, carries a CVSS v3.1 score of 9.8, and affects hardware widely deployed in data centers and energy facilities. Unrestricted access to industrial monitoring systems like these can directly affect the reliability and safety of critical infrastructure.
About Packet Power: Packet Power is a specialist vendor of wireless power and environmental monitoring for data centers, industrial sites, and critical infrastructure. Its EMX (Energy Management Exchange) and EG (Ethernet Gateway) products are used globally, process over 100 million data points per hour, and support deployments in more than 30 countries. Facility managers rely on these devices for real-time insight into power and environmental conditions, and for control over them.
Technical Information
CVE-2025-8284 comes from missing authentication enforcement in the Packet Power Monitoring and Control Web Interface for EMX and EG devices running firmware versions prior to 4.1.0. The web interface is served over HTTP, typically on port 80, and lets users view and change every monitoring and control function on the device. Affected versions ask for no credentials and no authentication of any kind before granting full access. The flaw is classified as CWE-306 (Missing Authentication for Critical Function).
The vulnerability is trivially exploitable. Anyone with network connectivity to the device can open the web interface and perform any supported operation, including altering monitoring parameters, viewing sensitive operational data, or changing device configurations. There is no evidence of any authentication logic in the affected firmware versions. The flaw is present in all default configurations, and exploiting it requires no special conditions or privileges.
No public code snippets or exploit scripts are available as of the publication date. The root cause is the complete absence of an authentication check in the web application's request-handling logic for critical functions.
Patch Information
Packet Power has released firmware version 4.1.0 for both EMX and EG devices to fix this vulnerability. The update makes authentication mandatory for the Monitoring and Control Web Interface, which prevents unauthorized access to device functions and unauthorized changes to them. Users are strongly advised to upgrade to version 4.1.0 to secure their systems.
Reference: CISA ICS Advisory ICSA-25-219-05
Affected Systems and Versions
- Packet Power EMX devices: all firmware versions prior to 4.1.0
- Packet Power EG devices: all firmware versions prior to 4.1.0
Every default configuration of these products is vulnerable. The vulnerability sits in the Monitoring and Control Web Interface, which is accessible over HTTP.
Vendor Security History
Packet Power has previously promoted advanced security features such as data diodes for highly secure environments. Even so, a missing authentication flaw in its core products points to a significant gap in secure development lifecycle practices. The sources reviewed for this post contain no prior public record of similar authentication bypasses in Packet Power products. The vendor responded to this disclosure by releasing a patch (firmware 4.1.0) and coordinating with CISA on the public advisory.
