Treck TCP/IP stack multiple vulnerabilities. (Ripple20)

[Anonymous user]

Hello, Treck TCP/IP stack multiple vulnerabilities. (Ripple20) issue was raised on the following UPS Management cards, AP9537SUM, AP9618 and OM-9631SY. What are the latest versions of Application Module, APAC OS, and Boot monitor that can be applied and will it Fix  the vulnerability?

Thanks

[BillP]

Hello,

Please see Schneider Electric security notification at this link

https://www.se.com/ww/en/download/document/SEVD-2020-174-01/

[BillP]

Hi,

We are releasing updated firmware to address this issue. Please see https://www.se.com/us/en/faqs/FA410359/ . The FAQ includes links to updated firmware based on SKU. 

[Anonymous user]

Hi Bill,

your second link doesn't work anymore.

Where can I download an update for AP9619? Thank you in advance!

[Brad_C]

On 21/8/2020 9:22 PM, Aleks said:

your second link doesn't work anymore.

It's still in the google cache (https://webcache.googleusercontent.com/search?q=cache:70mYIkJ2UloJ:https://www.apc.com/us/en/faqs/FA410359/). Unfortunately it lists anything for NMC1 or 2 as "Currently Unavailable".

I expect if it's going to happen, it'll take some time to build and validate upgrades for the AOS 3 stuff.

Be nice to get some info and/or ETAs, but at least the problem has been acknowledged.

[BillP · Accepted solution]

Hi,

FAQ FA410359 has been updated. Unfortunately, we had to remove reference's to the 6.9.2 firmware. When a new version of the firmware has been released I will update this thread.

Bill