TLStorm vulnerabilities

[EcoStruxureIT]

For a list of impacted products and remediations, please refer to Schneider Electric's security bulletin which contains the most up to date information:
https://www.se.com/ww/en/download/document/SEVD-2022-067-02/

Based on the current information and analysis available, the EcoStruxure IT Gateway is not impacted by the TLStorm vulnerabilities.

CVE-2022-22806 and CVE-2022-22805 

The IT Gateway uses a different TLS implementation than the affected UPSs. These vulnerabilities have not been discovered in that toolchain.

CVE-2022-0715

The EcoStruxure IT Gateway uses different authentication mechanisms and does not have user installable firmware like a UPS.

The IT Gateway does facilitate firmware updates to the NMC on the UPS, via the secure EcoStruxure IT Expert cloud application only, using officially released firmware packages.  It does not have the ability to update the firmware on the UPS itself.

IT Expert Device Security assessment

The Device Security assessment in IT Expert includes a TLStorm analysis.

For the most accurate device analysis, be sure to keep your APC Network Management Card (NMC) firmware up to date and your Gateway updated to the latest version.

[DanielB]

Hi. I use IT Expert for our 158 UPS in the field.

I still have the message that 121 devices are vulnerable to TLStorm.

I did update the NMC to 3.3.0.8 and I don't have any update to apply.

Below, you can see the info for all of the UPS.

Is there something that I need to do to fix this or hide the message if nothing else is required ?

Thank you

[JLehr]

Hi @DanielB,

You might have a look at the Device Security assessment in Reports section of IT Expert for guidance on any necessary mitigation for these devices.

There's guidance in the Security Handbook for NMC3 also.

You can also request support if needed.

We'll look into this and will get back to you shortly.

[DanielB]

Thank you

[JLehr]

Hi @DanielB,

Only the Network Management Card (NMC) firmware can be updated in IT Expert. There is separate firmware on the UPS device.

To mitigate the TLSStorm vulnerabilities, you need to update the UPS firmware. 

The security bulletin linked in this article has instructions on how to do so for each model family.

Here's the link again:
https://www.se.com/ww/en/download/document/SEVD-2022-067-02/