Critical HVAC and UPS Vulnerabilities Could Let Hackers Disrupt Data Centers
Claroty discovers critical vulnerabilities in Vertiv UPS and Trane HVAC controllers used in data centers.
Claroty researchers identified multiple critical vulnerabilities in Vertiv UPS network cards and Trane Tracer SC+ HVAC controllers widely deployed in data centers. The Vertiv flaws include authentication bypass and remote code execution that can be chained to disrupt power protection systems, while Trane vulnerabilities enable unauthenticated RCE and sensitive data disclosure affecting building management systems. Both vendors have been notified and patches are being developed to address these cyber-physical system risks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Vertiv?
Get an email when a new story names Vertiv, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearchers discovered critical vulnerabilities in widely-deployed HVAC and UPS systems that could allow attackers to disrupt essential data center operations through authentication bypass and remote code execution. These cyber-physical system flaws demonstrate how operational technology (OT) components often lack basic security controls, creating attack vectors that can cause physical damage or service disruption. The vulnerabilities highlight the critical need for treating industrial control systems and building management systems as high-priority security assets rather than purely operational equipment.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.