A team from Claroty discovered weaknesses in two commonly used data center products: the network cards linking Vertiv uninterruptible power supply (UPS) units to the network, and the Trane Tracer SC+ HVAC controller. These issues could potentially allow an attacker to bypass authentication, gain remote access, and seize control of the device completely.
Following that, a hacker could interfere with power supply or cooling either directly or use it as a starting point to access more of the network and linked systems. Both companies fixed the issues following their discovery, and there have been no accounts of either weakness being utilized in a real-world assault.
Although this is positive news, it is not a cause for complacency. The revelation of a vulnerability, whether fixed or not, provides clear directions to any aggressor who chooses to investigate it, showcasing a recurring theme. Regrettably, this is a recurring trend.
Common weaknesses in building control systems emerge frequently, and this is justified. Numerous of these systems can be traced back to decades ago, created to function alongside mainframes and old controls instead of contemporary, digitally linked infrastructure. Moreover, they operate silently in the background, receiving minimal attention compared to laptops or servers, despite being crucial for the functioning of data centers and several industrial firms.
The actual narrative revolves around the actions data center managers and other companies employing the same systems can undertake to preemptively handle these weaknesses and ensure comprehensive protection. Emphasizing the importance of readiness.
