Security Experts:

Connect with us

Hi, what are you looking for?


IoT Security

US Government Warns of Attacks Targeting UPS Devices

The US Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Energy this week issued guidance on mitigating attacks against uninterruptible power supply (UPS) devices.

The US Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Energy this week issued guidance on mitigating attacks against uninterruptible power supply (UPS) devices.

The two government organizations are aware of threat actors targeting internet-connected UPS devices – often abusing default login credentials – and they recommend immediately removing internet access to the management interface of these devices.

Designed to provide emergency power when normal power sources are lost, UPS devices are attached to networks for power monitoring and routine maintenance, or simply for convenience.

To prevent potential attacks targeting UPSs, organizations are advised to enumerate all such devices within their environments and make sure they are not accessible from the internet.

[ READ: CISA Releases Final IPv6 Security Guidance for Federal Agencies ]

If a UPS device must be accessible from the internet, organizations should employ protections such as multifactor authentication, the use of a virtual private network (VPN), and strong, difficult-to-guess passwords.

Furthermore, organizations should check their UPS devices for default usernames and passwords and change those.

CISA also recommends that organizations adopt login timeout/lockout features, in addition to adhering to strong password requirements for UPS devices and similar systems.

UPS devices are also prone to vulnerabilities that threat actors may try to exploit in attacks. Earlier this month, details were released on vulnerabilities affecting millions of UPSs from Schneider Electric subsidiary APC, which could be exploited remotely to alter device operations and cause physical damage.

Another security hole in the same devices could allow attackers to alter the firmware of the UPS and achieve long-lasting persistence on the network.

Related: CISA Warns Critical Infrastructure Organizations of Foreign Influence Operations

Related: CISA Releases Guidance on Securing Enterprise Mobile Devices

Related: NSA, CISA Issue Guidance on Selecting and Securing VPNs

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.