How to upgrade firmware or patch PDU against Ripple20 Treck TCP/IP Stack Vulnerabilities?

[Tom2112]

I have spent the last hour digging around on Schneider's horrible website trying to find a firmware update or patch for my APC AP8641 rack PDUs. They show up on nessus scans as vulnerable to Ripple20 due to their Treck TCP/IP Stack.

This web page seems to indicate that there is a firmware or OS update/patch for my model (AP86XX series PDU) that fixes these vulnerabilities. But they don't link to the patch. The links there to the release notes & presumably to the update/patch are dead links. (Nice work Schneider!)

https://www.apc.com/us/en/faqs/FA410359/

So I search their online support/documentation. No luck there either. The only download available for my model AP8641 is a security wizard CLI, which is great if I wanted to change the certificates or SSH keys. But that's NOT going to update the vulnerable TCP/IP stack.

Is there a patch for this vulnerability? If so why doesn't it come up when you search your support site? And an even better question: why doesn't this ridiculously overpriced powerstrip have an auto-update feature? A $5 Raspberry Pi Zero does. Why doesn't my $2,500 PDU?

[ThePie_apc]

Any updates on this? 

Adding in some "Top Experts" for assistance. 

@BillP @voidstar_apc @Erasmus_apc @TheNotoriousKMP_apc 

[BillP]

@Tom2112 

The 7.0.8 firmware can be downloaded at

https://www.apc.com/us/en/product/SFRPDU2G708/apc-rack-power-distribution-unit-firmware-revision-7-0...

The security handbook can be downloaded at

https://download.schneider-electric.com/files?p_Doc_Ref=SPD_LFLG-9VYK3D_EN&p_enDocType=System+user+g...

[ThePie_apc]

I noticed that when the PDU turns on, outlets that were previously set to 'off' turn back 'on'. How can I keep these outlets off during a power cycle? @BillP 

[ThePie_apc]

In the Outlet Configuration I found a option to keep the Outlet from turning back on after the PDU has a power cycle event.