CYREBRO

resource

Microsoft Patches 3 Zero-Days, HP Patches 16 UEFI Vulnerabilities & Critical Vulnerabilities patched in APC Smart UPS

March 10, 2022 

Microsoft Patches 3 Zero-Days & 3 Critical RCE vulnerabilities

As part of the monthly security rollup updates, Microsoft has patched 3 Zero-Days, one being actively exploited in the wild, and 3 Critical-Rated Microsoft Security vulnerabilities.  In total, Microsoft has patched 71 vulnerabilities, not including 21 Microsoft Edge vulnerabilities. 

The Vulnerabilities:

The Zero-Day vulnerabilities:

The RCE Vulnerabilities:

Mitigation:

CYREBRO recommends implementing the latest available Microsoft security/monthly rollup updates in all relevant systems as soon as possible.  References: Microsoft   

HP patches 16 UEFI firmware bugs allowing stealthy malware infections

HP has disclosed 16 high-impact UEFI firmware vulnerabilities that could allow threat actors to infect devices with malware that gains high privileges and remains undetectable by installed security software.  a capable threat actor could potentially exploit them to implant persistent firmware malware that survives OS updates and bypasses UEFI secure Boot, Intel Boot Guard, and virtualization security solutions. 

The Vulnerabilities:  The vulnerabilities are separated into three buckets based on the component/feature being exploited:

SMM Callout (Privilege Escalation)

SSM (System Management Module)

DXE (Driver eXecution Environment)

Affected Products:

These vulnerabilities affect multiple HP models, including laptops, desktop computers, PoS systems, and edge computing nodes.  Specific affected products are listed here. 

Mitigation:

CYREBRO recommends that those use affected products check the HP Customer Support-Software and Driver Downloads site to obtain the latest updates.  References: HP 

Critical Zero-Click Vulnerabilities in UPS Devices Patched

3 critical security vulnerabilities found in APC Smart-UPS devices. The vulnerabilities could allow remote code execution (RCE), allowing attackers to cause cyber and physical damage to critical infrastructure. 

The vulnerabilities:

Affected Products

Mitigation

CYREBRO recommends that those who use affected products do the following: 
  1. Install the patches available on the Schneider Electric website 
  1. If you are using the NMC, change the default NMC password (“apc”) and install a publicly-signed SSL certificate so that a potential attacker on your network will not be able to intercept the new password. To further limit the attack surface of your NMC, refer to the Schneider Electric Security Handbook for NMC 2 and NMC 3. 
  1. Deploy access control lists (ACLs) in which the UPS devices are only allowed to communicate with a small set of management devices and the Schneider Electric Cloud via encrypted communications. 
References: Armis