APC Smart-UPS SmartConnect family (SMT, SMC, SMTL, SCL, SMX series) - cloud-connected UPS firmware: A heap overflow in

CVSS 9.0CVE-2022-22805Firmware, BMC & network fabricTLStormcurated

Impact

A heap overflow in TLS packet reassembly gives an attacker code execution on the UPS's own controller - the device that decides whether your racks get power. From there an attacker can cut output, refuse to transfer to battery during a utility event, or (as Armis demonstrated on the bench) drive the unit until it physically burns. This is not a monitoring card compromise; it is the power train. A single UPS covering a GPU row kills every training job in that row with no checkpoint.

Who can reach it

Unauthenticated. The UPS initiates an outbound TLS connection to Schneider's cloud service, so an attacker who can intercept or MITM that connection - or who is simply on the same network segment as the UPS management port - reaches the vulnerable parser. No credentials, no prior foothold on the compute network.

What to do

Firmware flash on every affected UPS, pushed through the Schneider update tool or the cloud service. Cost is real: each unit must be updated individually and some models require the load to be transferred or the unit taken to bypass first, so this is a scheduled electrical maintenance window per unit, not a fleet-wide push. If you cannot patch promptly, block the UPS's outbound path to the SmartConnect cloud and put the management port on an isolated VLAN with no route to the internet.

References

https://www.se.com/ww/en/download/document/SEVD-2022-067-02/https://www.armis.com/research/tlstorm/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.