Attacking UPS Network Cards to Take Down Data Centers
Source Reddit Cybersecurity
Discussion
Two critical vulnerabilities with CVSSv3 scores of 9.8 were discovered in Vertiv's Liebert IS-UNITY-DP UPS network cards. These internet-connected devices are used for power management in data centers. Exploiting these flaws could disrupt power management operations, impacting data center availability. Vertiv has released updates addressing both vulnerabilities. The research highlights the importance of including UPS infrastructure in an organization's cyber-physical security considerations.
r/cybersecurity (opens in a new tab)u/clarotyofficial0 points0 comments
Team82 uncovered two vulnerabilities in Vertiv’s Liebert IS-UNITY-DP network cards, both assessed a CVSSv3 score of 9.8, and demonstrated how weaknesses in these internet-connected devices could be leveraged to disrupt power management operations supporting data centers.
The research explores attack paths, potential impacts on availability, and why UPS infrastructure should be considered part of an organization's cyber-physical attack surface.
Vertiv has provided updates that address both flaws.
Read the technical deep dive here: https://claroty.com/team82/research/attacking-ups-network-cards-to-take-down-data-centers
Links cited in the discussion
References
- vertiv.com/en-us/products-catalog/monitoring-control-and-management/monitoring/liebert-is-unity-dp-communications-card/ (opens in a new tab)
- reddit.com/r/cybersecurity/comments/1u9givj/attacking_ups_network_cards_to_take_down_data/ (opens in a new tab)
- claroty.com/team82/research/attacking-ups-network-cards-to-take-down-data-centers (opens in a new tab)