4 ms·
Why anyone would use a network connected UPS is beyond me. The networked microcontrollers in UPSes are taken from "IOT" product lines. Like internet-connected
by octoberfranklin 5y ago
Why anyone would use a network connected UPS is beyond me.
The networked microcontrollers in UPSes are taken from "IOT" product lines. Like internet-connected dishwashers.
- kalleboo 5y agoHow else am I supposed to manage it? I go to that site maybe 5 times a year. There are no servers on-premises, just a switch and Wi-Fi APs. It's connected to the mothership via fiber. It's on a management VLAN that has no direct internet access.
- LinuxBender 5y agoIn my opinion things like this would be solved by having a management node or management software that the devices are allowed to connect to with mutual auth and a pairing process initiated/completed at each end. No inbound connections allowed at all to the UPS. Not a single listening socket. Input the IP of the management node into the UPS and then log into the management node to complete the pairing process which should require the serial number of the device and a management key. Given the crappy keypads on most of these units optionally also allow a USB with preloaded configurations, power thresholds, battery cuttoff, alert levels, ATS settings, voltage thresholds, management IP, etc... UPS verifies encryption key on USB and decrypts configuration that was written by the management node, loads and runs it, LED/LCD display says "Conf vers nnxxxx loaded. Have a good day!"
- Nextgrid 5y agoIf it's on a separate VLAN with no internet access you're doing it right and would be immune to this vulnerability.