The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Yes—certain APC Smart-UPS models were affected by vulnerabilities that could let an attacker gain access or control under specific conditions. That does not mean every APC UPS is exposed, or that “millions” is a verified count of affected devices. Whether a unit is at risk depends on its series, UPS ID, firmware, and network or SmartConnect status.
What is TLStorm?
TLStorm is the name given to three vulnerabilities disclosed in 2022: CVE-2022-22805, CVE-2022-22806, and CVE-2022-0715. The first two involve TLS communications in cloud-connected Smart-UPS devices; the third involves inadequate firmware authentication. NHS England Digital described the potential impact as unauthorized access and control that could create a cyber-physical risk. The flaws are serious, but exposure depends on the affected unit and attack conditions.
How could an attacker exploit the vulnerabilities?
| CVE | Issue and potential impact | Conditions and severity reported by NHS England Digital |
|---|---|---|
| CVE-2022-22805 | TLS buffer overflow during packet reassembly; described as remote code execution. | Applies to cloud-connected devices. NHS England Digital said exploitation requires no user interaction; PRITS noted an attacker would need a man-in-the-middle position capable of impersonating Schneider Electric Cloud. CVSS v3.1 base score: 9.0. |
| CVE-2022-22806 | TLS authentication bypass or state confusion that can enable remote code execution through a network firmware upgrade. | Applies to cloud-connected devices. NHS England Digital said exploitation requires no user interaction; PRITS noted an attacker would need a man-in-the-middle position capable of impersonating Schneider Electric Cloud. CVSS v3.1 base score: 9.0. |
| CVE-2022-0715 | Insufficient firmware signing or authentication could allow malicious firmware to be installed. | NHS England Digital reported CVSS v3.1 scores of 8.9 for connected devices and 6.9 for non-connected devices. |
The “no user interaction” description for the first two vulnerabilities does not mean an attacker can reach and compromise any UPS over the public internet without a network prerequisite. PRITS’s alert specifies the man-in-the-middle condition; network placement and the device’s connectivity matter.
Which APC Smart-UPS devices are affected?
APC branding alone is not enough to determine whether a unit is affected. Schneider Electric’s security notification covers selected products and lists series including SMT, SMC, SCL, SMX, SRT, SMTL, SRC, XU, XP, CHS2, SURTD, and selected SRTL families. The applicable CVE and remediation vary by series ID and installed firmware. Use the vendor’s current security notification SEVD-2022-067-02 to check the exact unit; the notice’s version 7.0 is dated November 21, 2022, and its update history records added series IDs and remediation information.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
- 1500VA / 900W RELIABLE BACKUP POWER: The highest VA capacity available for home use; delivers short-term battery power to keep essential devices powered during blackouts, surges, and unexpected power interruptions
- TEN PROTECTED OUTLETS: Power your entire setup with 5 battery backup outlets for essential devices, and 5 surge-only outlets for peripherals. Plus built-in coaxial and Ethernet surge protection for added peace of mind
- AUTOMATIC VOLTAGE REGULATION (AVR): Corrects low voltage brownouts (88V+) and surges (+/-13%) without draining battery. Boosts or trims to stable 120V. Extends runtime for blackouts; Active PFC compatible for gaming PCs
- REPLACEABLE BATTERY & ENERGY STAR UPS: User-replaceable battery (APCRBC124, sold separately) for zero-downtime swaps. ENERGY STAR certified for 92%+ efficiency, cutting energy costs vs standard UPS units
- LCD DISPLAY PANEL: Features an intuitive LCD screen that displays real-time status information including battery charge level, estimated runtime, load capacity, and input voltage for easy monitoring of your power protection system
There is no authoritative total of affected deployed devices in the cited vendor notification, firmware notes, or government alerts. “Millions” should therefore not be read as a confirmed count.
How to check and remediate a unit
- Identify the exact unit. Record its Smart-UPS series, UPS ID, firmware version, and whether it uses SmartConnect or another network connection. Do not rely on the product family name alone.
- Match the series ID and firmware to the vendor notice. Consult Schneider Electric’s SEVD-2022-067-02 notification and the APC Smart-UPS Firmware Versions and Release Notes 4.3.8v10. Confirm the entries relevant to the unit and vulnerability rather than assuming a general firmware update applies.
- Read the remediation classification. The firmware notes define “Fully Remediated” as the vulnerability no longer being present, “Partially Remediated” as aspects remaining, “Not Remediated” as the vulnerability fully present, and “Not Applicable” as never present. They also warn that an ID missing from the table may have no available update or may not work with the Firmware Upgrade Wizard.
- Apply only model-appropriate vendor guidance. Follow the current notice and release notes for the exact ID and firmware. A general-purpose update or an update intended for a different UPS variant is not a safe substitute.
The March–April 2022 NHS England Digital alert is useful historical context, not a current patch-status list. At that time, NHS said updates fixed CVE-2022-22805 and CVE-2022-22806 for SmartConnect SMT and SMC units, while CVE-2022-0715 was only partially remediated there; remediation for other lines was then unavailable. The vendor’s current model-specific information should govern what to do now.
Rank #2
- Power Capacity: 1500VA / 900W Pure Sine Wave UPS battery backup provides reliable power protection for your equipment
- Connection Options: Input NEMA 5-15P plug with output featuring (8) NEMA 5-15R outlets for multiple device connectivity
- Automatic Voltage Regulation (AVR): Adjusts high and low voltages to a safe level, helping preserve the life of the battery and protect connected equipment
- APC SmartConnect Remote Monitoring: Easy to use remote monitoring feature via a secure portal that provides automatic notifications, firmware updates, and advanced support services. For all units purchased and/or registered after August 1, 2023, SmartConnect will be offered as a 6-month free trial
- Comprehensive Warranty Coverage: 2 years repair or replace warranty (excluding battery), 2 years for battery, and $150,000 Connected Equipment Protection Policy
What if the unit cannot be updated?
The NHS alert’s interim measures included disabling SmartConnect where applicable or disconnecting the unit’s network cable, placing it behind a firewall, and restricting access from outside networks. Because that advice dates from 2022, confirm with the current Schneider Electric notice or support guidance before changing connectivity or operating settings. For organizational environments, assess the UPS as part of the wider network and operational-technology security controls rather than treating it as an ordinary office appliance.
Quick Recap
Best Value
- GENUINE APC UPS BATTERY REPLACEMENT: For optimal performance, use APC-branded replacement battery cartridges with your APC Back-UPS and Smart-UPS, and check the product you receive to confirm it is APC-branded
- TESTED AND CERTIFIED RBC CARTRIDGE: Each APC Replacement Battery Cartridge (RBC) is tested and certified for compatibility to restore your APC UPS performance to original factory specifications
- MODEL-SPECIFIC COMPATIBILITY: APCRBC124 is compatible with APC Back-UPS models BX1500M, BR1500G, and Smart-UPS model SMC1000-2UC (verify compatibility before ordering)
- BACKED BY APC WARRANTY: Genuine APC replacement batteries are backed by a 2-year manufacturer warranty
Rank #4
- KEEPS DEVICES RUNNING DURING POWER OUTAGES: Reliable 550VA / 330W UPS battery backup that protects home office electronics and keeps essential devices powered during blackouts, surges, and unexpected power interruptions
- STAY CONNECTED WHEN IT MATTERS MOST: Delivers up to 22 minutes of runtime when powering a 100W load. Mid-Size battery backup for computers, Wi‑Fi routers, modems, external drives, NAS, and Smart-Home IoT devices
- POWER & CHARGE ALL YOUR ESSENTIAL DEVICES: 8 well‑spaced outlets (4 battery backup + surge protection, 4 surge‑only), provide reliable battery backup and surge protection for multiple devices
- INSTANT UPS STATUS & EASY BATTERY REPLACEMENT: Clear indicators and mutable audible alerts give quick UPS status updates. The battery is User‑replaceable with genuine APC replacement battery Model APCRBC110 (sold separately)
- ENHANCED PROTECTION FOR CONNECTED ELECTRONICS: Supported by a 3‑Year Warranty and $75,000 Equipment Protection, offering enhanced coverage for connected devices and added assurance against power‑related damage
Rank #3
- 1500VA/1000W PFC Sinewave Uninterruptible Power Supply (UPS): Uses sine wave output to provide battery backup power for Active PFC & conventional power supplies; Safeguards computers, workstations, network devices, and telecom equipment
- 12 NEMA 5-15R OUTLETS: 6 battery backup & surge protected outlets, 6 surge protected outlets; INPUT: NEMA 5-15P right angle, 45 degree offset plug with 5 foot power cord; 2 USB charge ports (1 Type-A, 1 Type-C) quickly charge phones and tablets
- MULTIFUNCTION, COLOR LCD PANEL: Displays immediate, detailed information on battery and power conditions; Color display alerts users to potential issues before they can affect critical equipment and cause downtime; Screen tilts up to 22 degrees
- AUTOMATIC VOLTAGE REGULATION (AVR): Corrects minor power fluctuations without switching to battery power; UL SAFETY CERTIFIED: Product has been tested in a UL certified lab and listed with UL as meeting or exceeding safety standards
- 3-YEAR WARRANTY – INCLUDING THE BATTERY; $500,000 Connected Equipment Guarantee; FREE PowerPanel Management Software (Download)
Sources
- Schneider Electric security notification SEVD-2022-067-02.
- NHS England Digital: TLStorm Remote Code Execution Vulnerability in APC UPS Systems, published March 10, 2022 and updated April 4, 2022.
- Puerto Rico Innovation & Technology Service: Multiple Vulnerabilities in Schneider Electric APC Smart-UPS Could Allow for Remote Code Execution, March 14, 2022.
- Schneider Electric: APC Smart-UPS Firmware Versions and Release Notes 4.3.8v10.
- Schneider Electric security notification index.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
