Release Notes for Smart-UPS Ultra 5-20 kW Firmware v2.5.3.2

[SwathiNaidu]

Affected Revision Levels

Component	File	Details
Smart-UPS Ultra 5-20 kW Application	apc_hw21_sucan_2-5-3-2.nmc3	UPS Application for Smart-UPS Ultra 5-20 kW.

For details on upgrading the UPS Network Management Card 3 (NMC 3) firmware, see the NMC3 User Guide.

NOTE: If you upgrade to firmware version 2.0 or later, you cannot downgrade to a firmware version lower than 2.0

If you downgrade from firmware version 2.4+ or later to a firmware version lower than 2.4, this will cause the card to be formatted, erasing all security certificates, encryption keys, configuration settings, and the event and data logs.

New Features

New Feature

There is no new feature in this release.

Fixed Issues

Fixed Issue	UPS Family
	SRTL Devices	SRYL Devices
Downloading the Event Log via the Web UI works as expected when the language is set to Japanese.	♦	♦
The correct On Battery status message will now appear on the Web UI Home page for Japanese.	♦	♦
The NMC will now allow UPS firmware updates when there is no network cable connected.	♦
Security Update
The following security vulnerability has been addressed in this release: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor SSH Cipher Block Chaining (CBC) cipher has been removed.	♦	♦
The following security vulnerabilities have been addressed in this release: CWE-523: Unprotected Transport of Credentials. Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server. CWE-319: Cleartext Transmission of Sensitive Information. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The user is now referenced as an index rather than their username, for example: NMC/KrtUvuh39YtQmHbyua297g/usercfg.htm?user=2	♦	♦
The following security vulnerability has been addressed in this release:   CWE-863: Incorrect Authorization The Network-Only user can only perform actions in the Web UI relevant to the user access level.	♦	♦
The following security vulnerability has been addressed in this release: CWE-598: Use of GET Request Method With Sensitive Query Strings. This software uses the HTTP GET method to process a request and includes sensitive information in the query string of that request. Configuration of HSTS is now independent from HTTP or HTTPS configuration. When HSTS is enabled an STS header is added to all responses over HTTPS.	♦	♦

Known Issues

Known Issue	UPS Family
	SRTL Devices	SRYL Devices
After updating the NMC’s firmware via a USB flash drive, the USB is not recognized in the display or NMC Web UI.	♦	♦
Some pages in the Web UI help are not updated.	♦	♦
It can take up to 30 minutes to complete a UPS firmware upgrade when using HTTPS. To workaround this, use SCP as an alternative.	♦	♦
The alarm description is shown incorrectly in DCE for outlet group-related alarms.	♦
You cannot unzip the debug file completely from a USB drive. This issue is seen intermittently.	♦
When a UPS firmware upgrade is in progress, the upsAdvcontrolFirmwareUpdate SNMP OID incorrectly reports the value as “noFirmwareUpdate” instead of “UpdateinProgress”.	♦
Filtering by time does not work for the Power Event Log.	♦
Entering unsupported commands in the Command Line Interface (CLI) does not return a E102 Parameter error.	♦
During the Setup Wizard, when selecting output voltage, the UPS may incorrectly indicate the input voltage present causing a warning on the display that can be dismissed.		♦
You are unable to configure some OIDs upsAdvConfigAlarmRedundancy, upsAdvConfigHighBypassLLTransferVolt, upsAdvConfigLowBypassLLTransferVolt from SNMP interface.		♦
Only alphanumeric passwords are supported for new users created in the NMC for access to the display.		♦
When an internal or external Battery Module is connected or disconnected from its slot, the Event Log entry does not report its serial number.		♦
You cannot make configuration changes via the display when RADIUS is enabled and the User Mode is set to “Authentication Needed”.		♦
The option to cancel or mute a UPS audible alarm is not present in the Web UI.		♦
The ups -s start CLI command is unsuccessful even when the self-test is started correctly.		♦
There is no option to set the language of the display in the NMC Web UI.		♦
There is no option in the Web UI or the display to cancel a UPS audible alarm test. It is not recommended to initiate a continuous alarm as the only way to stop the UPS beeping is to turn off the UPS.		♦
You cannot modify the output voltage setting from the SNMP interface if the output is in Manual Bypass.		♦
The “Minimum Redundancy lost" event is not displayed in PowerChute Network Shutdown although it is supported by the NMC. If this event occurs, the server will not shutdown.		♦

Hash Signatures

Signatures	apc_hw21_sucan_2-5-3-2.exe
CRC32	2E54EC39
CRC64	98A219688D9AB53A
SHA-256	AAEB1AAA993268CE20CB6E4F0CC42194D641D4DE399D418681208634B2F65B76
SHA-1	C581949A3BF58B6ED2284C95F44283095F2C40B7
BLAKE2sp	F8D9C2D3E1154AB7EB69825E95C9FF5B133D16EFA7E991325635C5B09C674E6E