Armis Uncovers Three Zero-Day Vulnerabilities in APC Smart-UPS Devices: Nups Patch Needed for Remote Management Security

In a recent announcement, Armis, the leader in unified asset visibility and security, disclosed the discovery of three zero-day vulnerabilities in APC Smart-UPS devices. These vulnerabilities, collectively known as TLStorm, have significant implications for organizations that rely on these devices to provide emergency backup power for mission-critical assets.

APC Smart-UPS devices are widely used in data centers, industrial facilities, hospitals, and other critical infrastructure, with over 20 million devices sold worldwide. According to Barak Hadad, Head of Research at Armis, 'Until recently, assets such as UPS devices were not perceived as security liabilities.' However, the recent discovery highlights the importance of addressing these vulnerabilities to prevent exploitation.

The TLStorm vulnerabilities allow threat actors to disable, disrupt, and destroy APC Smart-UPS devices and attached assets. If exploited, attackers can bypass security features and remotely take over or damage critical industrial, medical, and enterprise devices. This is particularly concerning given the widespread use of these devices in critical infrastructure, where downtime or disruption can have severe consequences.

Armis emphasizes the need for complete visibility of all assets, including remote management devices, to identify exploitation attempts of vulnerabilities like TLStorm. The company's research demonstrates that security mechanisms in remotely managed devices have not been properly implemented, leaving them vulnerable to attack.

The discovery of these zero-day vulnerabilities underscores the importance of proactive cybersecurity measures. Organizations relying on APC Smart-UPS devices must take immediate action to patch their devices and ensure the integrity of their critical infrastructure.

Armis urges security leaders to prioritize unified asset visibility and security, particularly in remotely managed devices. By doing so, they can better protect their organizations from emerging threats like TLStorm and minimize the risk of disruption or damage to critical assets.

Nups patch