Three Vulnerabilities Discovered in Popular UPS Devices
Security researchers have discovered a total of three vulnerabilities affecting uninterruptable power supply devices. The three vulnerabilities are collectively referred to as TLStorm and are causing concern due to the common use of similar UPS devices in critical infrastructure.
Around 20 million devices affected
The vulnerabilities were first discovered by a research team with Aramis Research. The flaws were discovered in UPS devices produced by APC, a subsidiary of Schneider Electric. The units affected by the vulnerabilities are the Smart-UPS devices manufactured by the company.
According to estimations, based on where the devices are used and the fact that around 20 million of them are in use, if the vulnerabilities are actively exploited by threat actors, this could lead to serious damage to both network systems and real-world infrastructure. The flaws discovered allow potential attackers to use the UPS devices to gain unauthorized access to a network and exfiltrate data, as well as cause disruption in services by cutting off power.
Vulnerabilities allow for eventual RCE
Two of the three total vulnerabilities discovered involve tampering with the error handling mechanism of Transport Layer Security, intervening in the steps where the devices connect to the cloud. The first two flaws, codified as CVE-2022-22805 and CVE-2022-22806, both have severity ratings of 9. They comprise a buffer overflow bug that could allow for remote code execution on the device and an authentication bypass. The bypass could also allow for RCE on the targeted device.
The bugs are triggered through what infosec calls "zero-click" - unauthenticated packets sent over the network without any sort of interaction or intervention on part of a user.
The final vulnerability is recorded as CVE-2022-0715 and constitutes a flaw that allows for applying firmware updates that have not been given secure cryptographic signatures.
In the wake of the ongoing war in Ukraine and the escalated tensions between Russia and the west, similar flaws that have the potential to impact important services, facilities, and critical infrastructure need to be addressed urgently.
