Hardcoded SSH Private Key in Eaton Power Xpert Meter 4000/6000/8000

Exploitation allows unauthenticated remote attackers to gain root access to any affected device using the distributed private key, enabling full control over the meter, potential manipulation of energy data, disruption of operations, and use of the device as a pivot point for further attacks. The uniform key across all devices enables large-scale compromise and lateral movement. Additional risks include exploitation of weak crypto algorithms, poor file permissions, and default credentials.

For unsupported or unpatchable devices, immediately isolate affected meters from untrusted networks, restrict network access to trusted management hosts, and disable SSH if possible. Monitor for unauthorized SSH access and rotate any credentials that may have been exposed. Replace end-of-life devices as soon as feasible.

Upgrade all supported Eaton Power Xpert Meter 4000/6000/8000 devices to firmware version 13.4.0.10 or later, which generates unique SSH key pairs per device. For devices running firmware 12.x and below (end-of-life), replacement with supported hardware is required, as no patch is available.