Smart-UPS & 1-Phase Symmetra

Affected Revision Levels   Component  File Details Smart-UPS Application apc_hw21_su_2-5-3-3.nmc3 UPS Application for Smart-UPS, Smart-UPS RT, Smart-UPS VT, MGE Galaxy 3500. Symmetra Application apc_hw21_sy_2-5-3-2.nmc3 UPS Application for 1-Phase Symmetra, Symmetra LX.   For details on upgrading the UPS Network Management Card 3 (NMC 3) firmware, see the NMC3 User Guide. NOTE: If you upgrade to firmware version 2.0 or later, you cannot downgrade to a firmware version lower than 2.0.     If you downgrade from firmware version 2.4+ or later to a firmware version lower than 2.4, this will cause the card to be formatted, erasing all security certificates, encryption keys, configuration settings, and the event and data logs.   New Features   New Feature There is no new feature in this release.   Fixed Issues   Fixed Issue UPS Family Smart-UPS 1-Phase Symmetra Downloading the Event Log via the Web UI works as expected when the language is set to Japanese. ♦ ♦   Security Update   The following security vulnerability has been addressed in this release:  CWE-200: Exposure of Sensitive Information to an Unauthorized Actor SSH Cipher Block Chaining (CBC) cipher has been removed. ♦ ♦ The following security vulnerabilities have been addressed in this release: CWE-523: Unprotected Transport of Credentials. Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server. CWE-319: Cleartext Transmission of Sensitive Information. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The user is now referenced as an index rather than their username, for example: NMC/KrtUvuh39YtQmHbyua297g/usercfg.htm?user=2 ♦ ♦ The following security vulnerability has been addressed in this release:   CWE-863: Incorrect Authorization The Network-Only user can only perform actions in the Web UI relevant to the user access level. ♦ ♦ The following security vulnerability has been addressed in this release: CWE-20: Improper Input Validation Incoming BACnet packet sizes are now validated. ♦ ♦ The following security vulnerability has been addressed in this release: CWE-598: Use of GET Request Method With Sensitive Query Strings. This software uses the HTTP GET method to process a request and includes sensitive information in the query string of that request. Configuration of HSTS is now independent from HTTP or HTTPS configuration. When HSTS is enabled an STS header is added to all responses over HTTPS. ♦ ♦   Known Issues   Known Issue There is no known issue in this release.   Hash Signatures Signatures apc_hw21_su_2-5-3-3.exe  CRC32 1B525C68 CRC64 1919EC007B13BC96 SHA-256 C641E5D549CB88F6CDF914A9BD79A3F450118FC9CE6ADA47EA35A5C96FFA77C1 SHA-1 BCF0BE585DD3E21AF7A3ADA8F7893B5A0B8F1198 BLAKE2sp 6DBF86236F9B6EE639B42A883F832182ADF9990D99801ECD5FA4B8D1E42F56FA   Signatures apc_hw21_sy_2-5-3-2.exe CRC32 04E90885 CRC64 20EA59213CDCA39E SHA-256 091163C905F29652AB41B4ABE12CA45402376B6CACD80E5911C9DDB2CC308134 SHA-1 FCFB7578356DFC98253BDDCBA2C483AF76DF8A43 BLAKE2sp 50CC9F255DE9DF12FB94C3AAD92661500CBB05FEB4A5DEF8BCDF1691529D4736  

Affected Revision Levels   Component  File Details Smart-UPS Application snst_nmc3_su_3-2-0-8.exe UPS Application for Smart-UPS, Smart-UPS RT, Smart-UPS VT, MGE Galaxy 3500. Symmetra Application snst_nmc3_sy_3-2-0-7.exe UPS Application for 1-Phase Symmetra, Symmetra LX.   To upgrade to firmware version 3.0 or later, the only supported method is the Secure NMC System (SNS) Tool, which can be downloaded from www.apc.com/secure-nmc or by searching for SFNMC3FMTSU. To access the firmware in the software, a valid Secure NMC subscription is required. For more information, see the SNS Tool User Guide.   NOTE: If you upgrade to firmware version 2.0 or later, you cannot downgrade to a firmware version lower than 2.0. If you downgrade from firmware version 2.4+ to a firmware version lower than 2.4, this will cause the card to be formatted, erasing all security certificates, encryption keys, configuration settings, and the event and data logs.   New Features   New Feature UPS Family Smart-UPS 1-Phase Symmetra The NMC3 platform and Smart-UPS and 1-Phase Symmetra applications are now IEC 62443-4-2 SL2 certified; a higher level of certification than SL1 announced in October 2023. ♦ ♦ Support added for optional Spot Fluid Sensor (NBES0301).   ♦ Support added for configuring Universal I/O sensors via the cfguio command on the Command Line Interface (CLI).   ♦ Support added for audit logging to ensure that control actions and configuration changes are recorded in the Event Log.   ♦ Security Update Support added for integrity checking of the configuration file. ♦ ♦   Fixed Issues   Fixed Issue UPS Family Smart-UPS 1-Phase Symmetra SSH and Telnet sessions now terminate as expected. ♦ ♦ The Web UI now supports the Primary and Secondary DNS fields with a maximum of 40 characters. ♦  ♦ An error no longer appears when trying to access certain Web UI pages as a Network-Only user. ♦  ♦ NMC no longer reboots when configuring 'Controlled Early Shutdown' parameters from the configuration file.  ♦   It is now possible to navigate from the Universal I/O status web page to other web pages.   ♦ Security Update The following security vulnerability has been addressed in this release: CWE-863: Incorrect Authorization The Network-Only user can only perform actions within the Web UI that corresponds to their access level. ♦ ♦ The following security vulnerability has been addressed in this release: CWE-20: Improper Input Validation Incoming BACnet packet sizes are now validated. ♦ ♦   Known Issues   Known Issue There is no known issue in this release.     Hash Signatures   Signatures snst_nmc3_su_3-2-0-8.exe CRC32 C35FC6F7 CRC64 96D9D206CEB88F5C SHA-256 CBEB12D026E980DB7431302A467ACEC8C33E622D18ABE7908A71A9B017A618DE SHA-1 C09CF0C69A1046EC7F15D929599BC536C6DCBB3B BLAKE2sp F7EF95B576FB88C4FB8EE5ECD7FE36C03A18BB05EDD1A19BEC49AC0A8B765DBD   Signatures snst_nmc3_sy_3-2-0-7.exe CRC32 3B9F46E1 CRC64 7AAD51767A944CF3 SHA-256 B147E22EA874C3B72FC40803C565D07143D1EDAFB8D4030A2F4BEF2BB2A19712 SHA-1 8B84CD15549CE397580335C226F6A8A79C07C045 BLAKE2sp B2A29546CE1CB5B5D64060F9C8CA915794BB702E3D643E6B81FDDCC70A0F1C83  

Affected Revision Levels   Component  File Details Smart-UPS Application snst_nmc3_su_3-1-1-1-v2.exe UPS Application for Smart-UPS, Smart-UPS RT, Smart-UPS VT, MGE Galaxy 3500. Symmetra Application snst_nmc3_sy_3-1-1-1-v2.exe UPS Application for 1-Phase Symmetra, Symmetra LX.   To upgrade to firmware version 3.0 or later, the only supported method is the Secure NMC System (SNS) Tool, which can be downloaded from www.apc.com/secure-nmc or by searching for SFNMC3FMTSU. To access the firmware in the software, a valid Secure NMC subscription is required. For more information, see the SNS Tool User Guide.   NOTE: If you upgrade to firmware version 2.0 or later, you cannot downgrade to a firmware version lower than 2.0. If you downgrade from firmware version 2.4+ to a firmware version lower than 2.4, this will cause the card to be formatted, erasing all security certificates, encryption keys, configuration settings, and the event and data logs.   New Features   New Feature UPS Family Smart-UPS 1-Phase Symmetra Support added for user authentication via Lightweight Directory Access Protocol (LDAP). ♦  ♦ Support added for baud rate 115,200 on the Console connection on Universal I/O port. ♦ ♦ Support added for optional Spot Fluid Sensor (NBES0301). ♦   Support added for configuring Universal I/O sensors via the cfguio command on the Command Line Interface (CLI). ♦   Support added for remote authentication via the TACACS+ protocol. (Added for Smart-UPS application in v3.0).   ♦ Security Updates Support added for TLS 1.3. ♦ ♦ Support added for SNMPv3 encryption via the SHA-256 and AES-256 protocols. ♦ ♦ Password security has been updated to align with the requirements for IEC 62443-4-2. By default, passwords now need to be a minimum of 8 characters in length (strong password setting enabled). (Added for Smart-UPS application in v3.0)   ♦   Fixed Issues   Fixed Issue UPS Family Smart-UPS 1-Phase Symmetra Link-RX/TX LED is now working for all embedded NMC3s. ♦   Dates in SNMP, such as upsAdvIdentDateOfManufacture, are now available in the correct format, mm/dd/yyyy. ♦   The audit log of the Web UI is displayed in all supported languages. ♦   The NMC3 Web UI now allows passwords with up to 64 characters, as expected. (Added for Smart-UPS application in v3.0)   ♦ For encrypted email settings, install CA certificate to the certificate store and set "Require CA Root Certificate" correctly. (Added for Smart-UPS application in v3.0)   ♦ Improved TLS certificate for email. (Added for Smart-UPS application in v3.0)   ♦ Security Update The following security vulnerability has been addressed in this release: CWE-327: Use of a Broken or Risky Cryptographic Algorithm. This software uses a broken or risky cryptographic algorithm or protocol. Removed support in SSH for diffie-hellman-group14-sha1. ♦ ♦ The following security vulnerability has been addressed in this release: CWE-598: Use of GET Request Method with Sensitive Query Strings. This software uses the HTTP GET method to process a request and includes sensitive information in the query string of that request. Configuration of HSTS is now independent from HTTP or HTTPS configuration. When HSTS is enabled, an STS header is added to all responses over HTTPS. ♦ ♦ The following security vulnerability has been addressed in this release: CWE-307: Improper Restriction of Excessive Authentication Attempts. This software does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. The account now gets locked after bad login attempts. ♦ ♦ The following security vulnerabilities have been addressed in this release: CWE-523: Unprotected Transport of Credentials.Login pages do not use adequate measures to protect the user nameand password while they are in transit from the client to the server. CWE-319: Cleartext Transmission of Sensitive Information.The product transmits sensitive or security-critical data in cleartext in acommunication channel that can be sniffed by unauthorized actors. The user is now referred as an index rather than the user name NMC/KrtUvuh39YtQmHbyua297g/usercfg.htm?user=2. ♦ ♦ The following security vulnerability has been addressed in this release: CWE-200: Exposure of Sensitive Information to An Unauthorized Actor SSH Cipher Block Chaining (CBC) cipher has been removed. ♦ ♦ The following security vulnerabilities have been addressed in this release: CWE-74: Improper neutralization of special elements in output used bya downstream component (Injection) CWE-79: Improper neutralization of input during web page generation (Cross-site Scripting). (Added for Smart-UPS application in v3.0)   ♦   Known Issues   Known Issue There is no known issue in this release.     Hash Signatures   Signatures snst_nmc3_su_3-1-1-1-v2.exe CRC32 51F99D98 CRC64 0E8E079EEEEB03FF SHA-256 55E762F6D3E8CF751527A30D109A730E5029BFED261A2D3AE4D645D2FFA0EA1F SHA-1 D6D4181A620C0606863C6F808774F9C3E773F70D BLAKE2sp 80A283A939A16A48ED554002F2E284AB862685370B2EDEF6FF51BF0232C65AB0     Signatures snst_nmc3_sy_3-1-1-1-v2.exe CRC32 63A316A1 CRC64 9B16BD59FB4FAA58 SHA-256 C9C2BA0E8CC0FFE7DE1716817E5AD74F19B46B8D80569F3E402BBA3D6A3FB6D7 SHA-1 929DFB72C2A94D71C2A0938FD0A675ABE8BAC4E9 BLAKE2sp BCD8B84A96027231279FDC88B20363F2384DAF55D2C99E7A3F62B9DB3ABB4FB1    

Affected Revision Levels   Component  File Details Smart-UPS Application apc_hw21_su_2-5-0-6.nmc3 UPS Application for Smart-UPS, Smart-UPS RT, Smart-UPS VT, MGE Galaxy 3500. Symmetra Application apc_hw21_sy_2-5-0-3.nmc3 UPS Application for 1-Phase Symmetra, Symmetra LX.   For details on upgrading the UPS Network Management Card 3 (NMC 3) firmware, see the NMC3 User Guide. NOTE: If you upgrade to firmware version 2.0 or later, you cannot downgrade to a firmware version lower than 2.0.   New Features   New Feature UPS Family Smart-UPS 1-Phase Symmetra SNMPv1 port number is now configurable. ♦  ♦ Support added for Dell VxRail for PowerChute Network Shutdown 4.5 or higher.   ♦ Security Updates The default value for Bad Login Attempts is now 5. In previous firmware versions, it was 0 (unlimited). If the number of Bad Login Attempts is exceeded, the user account will be locked out for 1 hour, or until the Super User or other admin-level account unlocks the account. The Web UI now reports "Invalid username or password" instead of "Account locked out" if the number of Bad Login Attempts is exceeded. These security updates affect all user accounts, including the Super User. ♦ ♦   Fixed Issues   Fixed Issue UPS Family SRTL Devices 1-Phase Symmetra The Network Interface on the NMC3 is communicating as expected. ♦ ♦     Hash Signatures   Signatures apc_hw21_sy_2-5-0-3.exe CRC32 FD350429 CRC64 2D3E12837A5AFB34 SHA-256 DA456C31CBA96971F5DC12D3B5B6B7A8F0332A5A9012DA513667BAAB120AD25B SHA-1 244DA6048A587BA78CB991F3AA97BBFE84205089 BLAKE2sp D478080AD2A59FBBAAA9F0E95F404BA752B8E57E841F149654E16802F636EB58     Signatures apc_hw21_su_2-5-0-6.exe CRC32 F8E22A16 CRC64 9EE5E803F84A30D0 SHA-256 9534F80631CF760F7C725446A8EEAECCA7DCF59302103E46C1E6DB9BD7B487E3 SHA-1 1A8A2F7E0942D4500CDE375D4E7C5CAEFA5E7120 BLAKE2sp 7BE54C58D5C4B84ACADEE7A2A5EBB0986EFB19A958CCC0A7A4584E5E9EAF478B

Affected Revision Levels   Component  File Details Smart-UPS Application apc_hw21_su_3-0-0-12.nmc3 UPS Application for Smart-UPS, Smart-UPS RT, Smart-UPS VT, and MGE Galaxy 3500.     To upgrade to firmware version 3.0 or later, the only supported method is the Secure NMC System (SNS) Tool, which can be downloaded from www.apc.com/secure-nmc or by searching for SFNMC3FMTSU. To access the firmware in the software, a valid Secure NMC subscription is required. For more information, see the SNS Tool User Guide. NOTE: If you upgrade to firmware version 2.0 or later, you cannot downgrade to a firmware version lower than 2.0.   If you downgrade from firmware version 2.4+ to a firmware version lower than 2.4, this will cause the card to be formatted, erasing all security certificates, encryption keys, configuration settings, and the event and data logs.   Schneider Electric Device IP Configuration Wizard  The Device IP Configuration Wizard is a Windows application designed specifically to remotely configure the basic TCP/IP settings of Network Management Cards. The Wizard runs on Windows® Server 2012, Windows Server 2016, Windows Server 2019, Windows 8.1, and Windows 10. This utility is for IPv4 only. NOTES: In firmware version v1.4.x and higher, it is not supported to assign IP addresses to Network Management Cards using the Wizard. You cannot search for assigned devices already on the network using an IP range unless you enableSNMPv1 and set the Community Name to “public”. For more information on SNMPv1, see the User Guide. When the NMC IP address settings are configured, to access the NMC Web UI in a browser, you must update the URL from http to https.   New Features   New Feature The NMC3 platform and Smart-UPS application are now IEC 62443-4-2 certified. Support has been added for audit logging to ensure control actions and configuration changes are recorded in the Event log. Support has been added for remote authentication via the TACACS+ protocol. Security Update Password security has been updated to align with the requirements for IEC 62443-4-2.The NMC now supports UPS firmware updates while the UPS is in Manual Bypass mode.     Fixed Issues   Fixed Issue SNMP OID upshighprecbatterypackonly now correctly displays all information about Battery Packs. The NMC3 Web UI now allows passwords with up to 64 characters, as expected. For encrypted email settings, install CA certificate in the certificate store and set "Require CA Root Certificate" correctly. Improved TLS certificate for email. Security Update The following security vulnerabilities has been addressed in this release: CWE-74: Improper neutralization of special elements in output used by a downstream component (injection) CWE-79: Improper neutralization of input during web page generation (Cross-site Scripting).   Known Issues   Known Issue The audit log of the Web UI is currently only available in English.     Hash Signatures   Signatures snst_nmc3_su_3-0-0-12.exe CRC32 CED0ED3C CRC64 0561C9C18A9E643C SHA-256 EB5245DFC880F7A8F4FA17484347FA9E0E4BE7EF1FD7E7C6FDA441A268E084D2 SHA-1 A7A7197534FD0FD4F6D8950ACFB6537F59D69FCC BLAKE2sp B33E36481699B0A7B5A029E78EC47914C5D0192614B79C794EE399689C7CE4D9