APC Smart-UPS SmartConnect family (SMT, SMC, SMTL, SCL, SMX series) - TLS state machine: PHYSICAL. A TLS authentication

Impact

PHYSICAL. A TLS authentication bypass by capture-replay: a malformed handshake puts the UPS into an unauthenticated-but-connected state, letting an attacker talk to it as if it were the trusted cloud service. Combined with the unsigned-firmware issue below, this is the full chain from network reachability to controlling whether a GPU hall stays energised.

Who can reach it

Unauthenticated, network-adjacent to the UPS management interface or positioned on the path of its outbound cloud connection.

What to do

Same firmware campaign as CVE-2022-22805 - a per-unit flash with an electrical maintenance window for models that need a bypass transfer. Interim mitigation is network isolation of the UPS management plane and blocking its egress. There is no configuration toggle that removes the vulnerable code path.

References