3 ms·
How else am I supposed to manage it? I go to that site maybe 5 times a year. There are no servers on-premises, just a switch and Wi-Fi APs. It's connected to th
by kalleboo 5y ago
How else am I supposed to manage it? I go to that site maybe 5 times a year. There are no servers on-premises, just a switch and Wi-Fi APs. It's connected to the mothership via fiber.
It's on a management VLAN that has no direct internet access.
- LinuxBender 5y agoIn my opinion things like this would be solved by having a management node or management software that the devices are allowed to connect to with mutual auth and a pairing process initiated/completed at each end. No inbound connections allowed at all to the UPS. Not a single listening socket. Input the IP of the management node into the UPS and then log into the management node to complete the pairing process which should require the serial number of the device and a management key. Given the crappy keypads on most of these units optionally also allow a USB with preloaded configurations, power thresholds, battery cuttoff, alert levels, ATS settings, voltage thresholds, management IP, etc... UPS verifies encryption key on USB and decrypts configuration that was written by the management node, loads and runs it, LED/LCD display says "Conf vers nnxxxx loaded. Have a good day!"
- Nextgrid 5y agoIf it's on a separate VLAN with no internet access you're doing it right and would be immune to this vulnerability.