Most IT security checklists cover firewalls, endpoint detection, and patch management. UPS systems rarely make the list.
That is a problem, because network-connected UPS devices are now a documented and actively researched attack surface, one that sits physically close to your most critical infrastructure and is frequently left out of standard vulnerability management programs.
This post covers how the attacks actually work, what the confirmed vulnerabilities look like, and what you can do to reduce your exposure.
Why UPS Systems Are Now a Cybersecurity Target
A UPS used to be a sealed box. You plugged it in, it protected your servers during outages, and nobody gave it much thought from a security perspective.
That changed when manufacturers started adding network management cards, cloud connectivity, and remote monitoring software. These features are genuinely useful, you can check load, battery health, and estimated runtime from a dashboard without walking into the server room. But every network connection is also a potential entry point.
UPS devices now sit on the same networks as your servers, switches, and storage. In many deployments, they are treated as facilities equipment rather than IT assets, which means they are routinely excluded from:
- Firmware update schedules
- Vulnerability scanning
- Network segmentation policies
- Asset inventory systems
That gap is exactly what attackers look for. A device with network access and no patching history is an attractive target, regardless of what it does.
The Two Main Attack Vectors
1. Firmware Attacks
UPS firmware controls everything: how the device responds to input power fluctuations, when it switches to battery, how it signals connected equipment during an outage. If an attacker can push malicious firmware, they control that behaviour.
CVE-2022-0715, disclosed in March 2022 as part of the TLStorm research by Armis Security, demonstrated this risk in APC Smart-UPS devices. The firmware update mechanism was encrypted but not cryptographically signed. That distinction matters: encryption protects data in transit, but without a signature, the device has no way to verify that the firmware actually came from the manufacturer.
An attacker who could reach the device through the SmartConnect cloud platform, the local network management card, or a direct USB connection could deploy malicious firmware with no authentication required.
The consequence is not just data exposure. A compromised UPS can cut power to connected systems, create false load readings, or stay dormant until a specific trigger condition is met.
2. Network Management Cards (NMC)
Network management cards slot into UPS chassis and provide the remote monitoring interface. They run their own embedded OS and web server, and they have their own vulnerability history.
In November 2021, CISA advisory ICSA-21-313-01 covered weaknesses in Schneider Electric NMC2 cards used in Smart-UPS, Symmetra, and Galaxy 3500 systems. CVE-2021-22815 (CVSS 5.3) allowed unauthenticated remote access to the device's troubleshooting archive, configuration data accessible with no credentials and no user interaction required.
Separately, cross-site scripting vulnerabilities in the NMC web interface could be used to execute malicious code in an authenticated user's browser session.
These are not flashy vulnerabilities. They are the kind of low-visibility exposures that appear in lateral movement chains after an attacker has obtained access somewhere else on the network.
What an Attacker Actually Gets
UPS access is rarely the end goal. It is a stepping stone. Here is what that looks like in practice:
Pivot into OT/ICS environments. UPS systems often bridge IT and operational technology networks. A compromised UPS provides a foothold in a network segment that may have weaker monitoring than corporate IT.
Physical disruption. Malicious firmware can change how a UPS responds to power events. In a data centre context, this can mean unplanned shutdowns, hardware damage, or outages timed to coincide with a separate attack.
Credential harvesting. Unauthenticated access to NMC configuration archives (CVE-2021-22815) can expose credentials that are reused elsewhere on the network.
How to Reduce Your Exposure
None of this requires exotic technical work to address. The fixes are mostly about applying the same discipline to UPS systems that you already apply to other networked infrastructure.
Apply vendor patches
Schneider Electric has released patches for all vulnerabilities listed here. If you are running APC Smart-UPS hardware, check your firmware versions against the relevant CISA advisories and update. For NMC2 cards in Smart-UPS, single-phase Symmetra and Galaxy 3500, AOS v6.9.8 and prior are affected. Update to v7.0.4 or later of theNMC2 SUMX or SY application.
Segment your UPS devices from general IT networks
UPS devices and management software should not share a flat network with general IT systems. Place them on a dedicated VLAN with firewall rules that restrict inbound access to authorised management hosts only. This limits an attacker's ability to pivot to or from UPS infrastructure even if they obtain access elsewhere.
Disable services you are not using
If you are not using the SmartConnect cloud management platform, disable it. Every exposed service that is not actively needed is a potential entry point.
Build and maintain a UPS asset inventory
Many organisations do not have an accurate count of UPS devices on their network, let alone their firmware versions. An inventory is the prerequisite for everything else on this list.
Change default credentials
Every network management card ships with default credentials. Change them before deployment. This is standard practice for IT equipment, but it is consistently overlooked with UPS hardware.
Monitor for anomalous network behaviour
UPS devices have predictable, stable network behaviour under normal conditions. Unexpected outbound connections, unusual data volumes, or firmware version changes are worth alerting on if your monitoring platform supports it.
The Right UPS Setup Starts at the Design Stage
Security posture for UPS infrastructure is significantly easier to get right before systems go live than after. The right equipment selection, correct network placement, and a clear firmware management process all come together at the design stage.
If you are assessing UPS systems for a new data centre or server room deployment, or reviewing the security of an existing installation, the team at UPS Solutions can advise on network-connected UPS options and secure deployment practices suited to your environment.