"Zero-Click Flaws in Widely Used UPS Devices Threaten Critical Infrastructure"

Researchers at Armis Research Labs have discovered a set of vulnerabilities in smart Uninterruptible Power Supply (UPS) devices. The vulnerabilities, discovered in APC Smart-UPS products and collectively dubbed TLStorm, could allow attackers to disrupt business operations, cause data loss, and physically harm critical infrastructure. There are about 20 million APC Smart-UPS devices deployed worldwide to provide emergency backup power for mission-critical assets in need of high availability. If exploited, the vulnerabilities could cause widespread disruption and damage in both the cyber and physical realms. For example, the exploitation of TLStorm vulnerabilities could allow malicious actors to remotely take over the devices and use them to infiltrate a company's internal network and steal data. If attackers were to cut off power for mission-critical appliances or services, they could cause physical injury or disrupt business services. The latest APC Smart-UPS models are controlled via a cloud connection, so a threat actor who successfully exploits TLStorm vulnerabilities can remotely take over devices from the Internet without any user interaction. In addition, an attacker can exploit the flaws to remotely execute code on a device, which could be used to change the operation of the UPS, potentially physically damaging the device itself or other assets connected to it. Schneider Electric, in collaboration with Armis, developed patches for the vulnerabilities, which were then distributed to customers and made available on the Schneider Electric website. It remains unknown as to whether the vulnerabilities have already been exploited. The discovery of TLStorm vulnerabilities highlights the volatility of devices in enterprise networks that are needed for power reliability and other critical infrastructure. This article continues to discuss the potential exploitation and severity of the TLStorm vulnerabilities, as well as the patches and workarounds shared to mitigate the vulnerabilities. 

Threatpost reports "Zero-Click Flaws in Widely Used UPS Devices Threaten Critical Infrastructure"