SCP Privilege Escalation Issue (7/28/2026)

We have identified a critical vulnerability in the SCP implementation used by the affected products. The vulnerability allows authenticated users to execute certain SCP operations even when the user’s assigned permissions should prohibit those actions.

As a result, an authenticated user could:

• overwrite any writable file with another file (e.g., a configuration file)
• copy any file to a writable location (possibly allowing download by other means)

NOTE: Successful authentication is first required. This issue cannot be exploited without valid user credentials.

Affected Product(s):

• Raritan PX2/PX3/PXC/PXO Rack PDUs
• Raritan PX3 Inline Meters
• Raritan PX3TS Rack Transfer Switches
• Raritan PX4 Rack PDUs
• Raritan PX4 Inline Meters
• Raritan SRC Smart Rack Controllers
• Raritan BCM2 Branch Circuit Monitoring System
• Legrand LP Rack PDUs

To address this issue, please upgrade an affected product to Xerus Firmware v4.3.14+.

Read more here to understand the root cause.