APC Smart-UPS SmartConnect family (SMT, SMC, SMTL, SCL, SMX series) - TLS state machine: A TLS authentication bypass by

CVSS 9.0CVE-2022-22806Firmware, BMC & network fabricTLStormcurated

Impact

A TLS authentication bypass by capture-replay: a malformed handshake puts the UPS into an unauthenticated-but-connected state, letting an attacker talk to it as if it were the trusted cloud service. Combined with the unsigned-firmware issue below, this is the full chain from network reachability to controlling whether a GPU hall stays energised.

Who can reach it

Unauthenticated, network-adjacent to the UPS management interface or positioned on the path of its outbound cloud connection.

What to do

Same firmware campaign as CVE-2022-22805 - a per-unit flash with an electrical maintenance window for models that need a bypass transfer. Interim mitigation is network isolation of the UPS management plane and blocking its egress. There is no configuration toggle that removes the vulnerable code path.

References

https://www.se.com/ww/en/download/document/SEVD-2022-067-02/https://www.armis.com/research/tlstorm/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.