Mitigating Attacks Against Uninterruptable Power Supply (UPS) Devices

[SynoMan]

Mitigating Attacks Against Uninterruptable Power Supply Devices | CISA

www.cisa.gov

 

[WST16]

Mitigating Attacks Against Uninterruptable Power Supply Devices | CISA

www.cisa.gov

Oh dear. Now we have to worry about the UPS getting hacked too?!
Mine is a stupid one that doesn’t know that it’s own battery is about to die. I’m not worried

 

[fredbert]

threat actors gaining access to a variety of internet-connected uninterruptable power supply (UPS) devices, often through unchanged default usernames and passwords.

Organizations can mitigate attacks against their UPS devices, which provide emergency power in a variety of applications when normal power sources are lost, by removing management interfaces from the internet.

While you could ask why the UPS management interface needs to be directly accessible from the Internet, there seems to be a simple step that it seems many omit when setting up routers, IoT, NAS, and a host of other devices too ... change the default usernames and passwords.