CVE-2018-7820
📋 TL;DR
This vulnerability in APC UPS Network Management Card 2 allows remote attackers to view Remote Monitoring credentials in plaintext when Remote Monitoring is enabled and then disabled. It affects organizations using APC UPS devices with vulnerable network management cards. Attackers can potentially gain administrative access to power management systems.
💻 Affected Systems
- APC UPS Network Management Card 2
📦 What is this software?
Ap9630 Firmware by Schneider Electric
Ap9631 Firmware by Schneider Electric
Ap9635 Firmware by Schneider Electric
Smart Ups Srt 5kva Firmware by Schneider Electric
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative credentials, compromise UPS management systems, potentially causing power disruptions or using the device as a foothold into the network.
Likely Case
Attackers harvest credentials from vulnerable devices, gain unauthorized access to UPS management interfaces, and potentially disrupt power monitoring or configuration.
If Mitigated
With proper network segmentation and access controls, impact is limited to the UPS management interface only.
🎯 Exploit Status
Exploitation requires access to the device interface and knowledge of the specific configuration sequence.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: AOS v6.5.7 or later
Vendor Advisory: https://www.apc.com/salestools/CCON-BFQMXC/CCON-BFQMXC_R0_EN.pdf
Restart Required: Yes
Instructions:
1. Download latest firmware from APC website. 2. Log into UPS management interface. 3. Navigate to Firmware Update section. 4. Upload and apply firmware update. 5. Reboot device.
🔧 Temporary Workarounds
Disable Remote Monitoring
allPermanently disable Remote Monitoring feature to prevent credential exposure.
Network Segmentation
allIsolate UPS management interfaces on separate VLAN with strict access controls.
🧯 If You Can't Patch
- Segment UPS management network from production systems
- Implement strict firewall rules limiting access to UPS management interfaces
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in web interface: System > About. If version is exactly 6.5.6, device is vulnerable.Check Version:
Check via web interface or SNMP: snmpwalk -v2c -c community_string device_ip 1.3.6.1.4.1.318.1.1.1.1.2.3.0Verify Fix Applied:
Verify firmware version shows 6.5.7 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts to UPS interface
- Unauthorized configuration changes to Remote Monitoring settings
Network Indicators:
- Unusual traffic to/from UPS management ports (80, 443, 161)
- Credential harvesting attempts
SIEM Query:
source="ups_logs" AND (event="failed_login" OR event="config_change")