Finding APC assets vulnerable to TLStorm

(updated ), by Pearce Barry
icon

Researchers at Armis recently published details on three new vulnerabilities affecting cloud-connected APC Smart-UPS devices manufactured by Schneider Electric. Dubbed “TLStorm”, two of these vulnerabilities exist in the firmware TLS implementation, while the third vulnerability exists in the firmware update process.

The disclosed CVEs for TLStorm include:

  • CVE-2022-22806 (CVSS “critical” score of 9.9) - Authentication bypass via state confusion during TLS handshake
  • CVE-2022-22805 (CVSS “critical” score of 9.9) - Pre-authentication buffer overflow in TLS
  • CVE-2022-0715 (CVSS “high” score of 8.9) - Unsigned firmware deployment via the network or USB

What is the impact of TLStorm?

Successful exploitation of these vulnerabilities can provide unauthenticated remote code execution to a remote attacker on vulnerable APC devices that are using the SmartConnect feature (which connects them to the cloud). This opens the door to attacks that could damage the UPS device itself, attacks that could damage devices connected to the UPS, and the attacker establishing a foothold on the private corporate network..

Is an update available?

Armis coordinated with Schneider Electric on the publishing of TLStorm, and Schneider Electric encourages owners of affected APC Smart-UPS devices to update with available patched firmware. Armis offers additional mitigation techniques for improved safety (see “How can you secure your UPS devices?”).

How do I find potentially vulnerable APC assets with runZero?

From the Asset Inventory, use the following pre-built query to locate APC assets within your network that are potentially vulnerable to TLStorm:

hw:apc AND protocol:tls
Find APC assets

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

Find APC Smart-UPS devices on your network

runZero deploys and bulds your asset inventory in minutes. Get results immediately.

Start a free trial
Rumble Screenshot

Similar Content

August 4, 2022

Finding DrayTek Vigor routers

The Trellix Threat Labs Vulnerability Research team recently published vulnerability details affecting almost 30 models of DrayTek Vigor routers. This vulnerability resides in the management interface login page and is trivial to exploit via buffer overflow. An …

Read More

July 29, 2022

Hunting for X.509 Certificates

X.509 certificates are used to secure communications over both trusted and untrusted networks. Protocols such as Transport Layer Security (TLS) rely on X.509 certificates to keep their communications secure between endpoints. Each X.509 certificate is composed of a public …

Read More

June 21, 2022

Finding Microsoft VPN/PPTP with runZero

Last month, researcher Alex Nichols at Nettitude reported a vulnerability in Microsoft’s Windows VPN software that could allow for remote code execution or local privilege escalation by an attacker. This vulnerability lies in a use-after-free condition that can occur in the …

Read More