# Packet Power EMX and EG missing authentication flaw

Published: 2025-08-07 · Severity: routine · Sectors: energy
Canonical: https://vorant.io/reports/81791a32-08e9-5966-98c2-d0a7493f935f/packet-power-emx-and-eg-missing-authentication-flaw

> Missing authentication in Packet Power EMX and EG monitoring interfaces allows unauthenticated remote full device access.

Packet Power's EMX and EG devices contain a critical missing authentication vulnerability (CVE-2025-8284, CWE-306) in their monitoring and control web interfaces. By default, these interfaces do not enforce authentication mechanisms, allowing an unauthenticated attacker with network access to gain full control of affected devices without credentials. The vulnerability has a CVSS v3.1 score of 9.8 and CVSS v4 score of 9.3, indicating remote exploitability with low attack complexity and no user interaction required.

All versions of EMX and EG prior to 4.1.0 are affected. These devices are deployed worldwide in critical energy infrastructure. CISA reports no known public exploitation at this time, but the ease of exploitation and severity demand immediate patching. Affected organizations should update to version 4.1.0 or later immediately.

Defenders should isolate these devices from direct internet exposure, require VPN for any remote access, and ensure proper network segmentation. Organizations should verify their monitoring and control systems are not accessible from untrusted networks and implement network access controls to restrict management interfaces.

## Mentioned in this report

- Vulnerabilities: CVE-2025-8284

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/81791a32-08e9-5966-98c2-d0a7493f935f/packet-power-emx-and-eg-missing-authentication-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup