Is Your UPS a Security Risk? Securing Network Management Cards Against Cyberattacks

A network-connected UPS is no longer just a battery-backed electrical device. Its network management card (NMC) can report power conditions, send alerts, upload firmware, communicate with monitoring software, and: depending on the model and configuration: initiate shutdown commands. That connectivity improves uptime visibility, but it also creates another access path into critical infrastructure.

For IT managers, facility managers, and security teams, the question is not whether remote UPS management is useful. It is whether that management interface has been secured like any other operational technology asset. An exposed or poorly configured NMC can become a foothold for credential abuse, lateral movement, unauthorized configuration changes, or disruption of protected loads.

Why Now: Remote Visibility Cannot Replace Security

Many organizations still treat UPS network cards as “set-and-forget” devices. They are installed by an electrical contractor, assigned an IP address, connected to a monitoring platform, and then forgotten until an alarm occurs.

That approach is failing because modern facilities are more distributed and more dependent on remote operations. A single management interface may be reachable from an enterprise VLAN, a building management network, a cloud monitoring service, or a vendor support connection. If those paths are not controlled, the card becomes part of a larger attack surface.

The risk is amplified by the authority these devices possess. An attacker who gains administrative control may be able to change shutdown thresholds, disable notifications, alter firmware, control outlets, or interfere with the sequence used to protect servers during a prolonged outage. In a data center, the result can be more serious than a compromised webpage: it can undermine power Redundancy and operational continuity.

CISA and the U.S. Department of Energy have specifically advised organizations to identify all internet-connected UPS devices, remove management interfaces from the public internet, and change factory-default credentials. Their guidance is applicable to businesses of every size: not only hyperscalers and critical infrastructure operators.

What a Network Management Card Can Control

The exact capabilities vary by UPS model and manufacturer, but an NMC commonly provides:

• Input and output voltage, frequency, load, and battery data
• Battery health and runtime information
• Event logs and alarm notifications
• Firmware and configuration management
• Email, syslog, SNMP, or cloud monitoring
• Remote UPS restart, shutdown, or load-segment control
• Automated server shutdown coordination

A 3,000 VA UPS protecting switches and servers may have a modest power rating, but its management interface can still influence the availability of an entire network closet. Larger three-phase systems may protect hundreds of kilowatts or multiple megawatts of IT load. In every case, the card should be classified according to what the UPS protects and what commands the interface permits.

The Five Most Common NMC Security Gaps

1. Default credentials remain active

Default credentials are among the fastest ways to compromise an internet-connected device. Older APC network management cards are widely associated with the default apc/apc login. Some CyberPower NMC documentation identifies password as a default management password. The exact behavior depends on the model, firmware generation, and configuration, so never assume that a newer device is automatically secure.

Current APC by Schneider Electric NMC3 security documentation describes more hardened behavior, including user accounts that must be configured before use. That does not eliminate the need for an account review. It means the administrator must verify the actual state of the device rather than rely on product age or branding.

At installation:

• Change every default username and password.
• Disable unused accounts.
• Create separate administrator, device-operator, and read-only accounts.
• Use unique passphrases stored in an approved password manager.
• Enable login timeout and lockout features where available.
• Do not share UPS administrator credentials with a general facilities or vendor account.

A monitoring operator usually does not need the authority to shut down a UPS. Least privilege should apply to power infrastructure just as it does to servers and firewalls.

2. Firmware is treated as maintenance instead of security

Firmware vulnerabilities can affect web interfaces, network protocols, authentication, and file-transfer functions. A UPS may continue to provide clean power while its management card remains exposed to a known vulnerability.

Build every NMC into the organization’s asset inventory. Record:

• Manufacturer and exact card model
• UPS model and serial number
• IP address and management VLAN
• Current UPS and NMC firmware versions
• Enabled services and protocols
• Administrative owner
• Maintenance and firmware review dates

Use firmware packages and security advisories from the manufacturer’s official support channels. Test updates where possible, schedule changes during an approved maintenance window, export configurations before making changes, and document rollback procedures.

After an update, verify that passwords, certificates, firewall rules, SNMP settings, logging, and access-control lists remain correct. Firmware upgrades can change defaults or disable features that monitoring depends on.

3. The NMC sits on a flat network

A UPS management card should not share an unrestricted VLAN with employee workstations, guest devices, printers, or general-purpose servers.

Place NMCs on a dedicated management VLAN or operational technology segment. Then use a stateful firewall or access-control lists to permit only documented traffic from approved systems, such as:

• A UPS monitoring server
• A data center infrastructure management platform
• A security scanner
• An authorized jump host
• A controlled vendor support path

For remote administration, require VPN access with multifactor authentication and route administrators through a hardened jump host. Do not publish the NMC’s HTTPS interface directly to the internet.

A defensible architecture separates the UPS devices from the systems that consume their telemetry. Monitoring data can move through a controlled management or DMZ segment, while configuration and shutdown commands remain limited to a smaller group of authorized hosts.

4. SNMP is enabled without understanding its risks

SNMP remains common because monitoring platforms use it to collect UPS data and receive traps. The problem is that SNMPv1 and SNMPv2c rely on community strings that are transmitted without modern encryption. Common strings such as public and private are not acceptable security controls.

If SNMP is not required, disable it. If monitoring requires SNMP:

1. Use SNMPv3.
2. Configure authentication and privacy: often described as authPriv.
3. Prefer SHA authentication and AES encryption when supported.
4. Use unique credentials rather than shared community strings.
5. Restrict permitted SNMP managers by IP address and firewall policy.
6. Use read-only access unless write operations are explicitly required.
7. Monitor for unexpected SNMP SET requests and configuration changes.

SNMP write access deserves particular scrutiny. A read-only monitoring account may expose status information; a write-capable account may change settings or issue control commands. The principle should be simple: telemetry access does not automatically justify control access.

5. Secure protocols are available but unused

For browser access, use HTTPS with the strongest supported TLS configuration. APC and Schneider Electric documentation recommends using TLS 1.2 where supported and disabling older protocol versions. Replace internally generated or default certificates with certificates issued by an enterprise or trusted certificate authority when the deployment warrants it.

For command-line access, use SSHv2 rather than Telnet. Telnet transmits credentials and session data without encryption. For file transfers, use SCP instead of FTP where supported. Disable HTTP, Telnet, FTP, legacy SNMP, unused IP stacks, and any other service that is not required.

Changing a port number may reduce noise from automated scans, but it is not a substitute for authentication, segmentation, and patching. Security comes from access control: not obscurity.

The UPS Security Roadmap

Facility and IT teams can begin with these five steps today:

1. Create an inventory.
   Locate every UPS, embedded network interface, NMC, cloud-connected SmartConnect device, and monitoring gateway. Include systems installed in server rooms, wiring closets, laboratories, clinics, and remote offices.

2. Remove direct internet exposure.
   Check firewall, NAT, port-forwarding, and cloud-support rules. Management interfaces should not be directly reachable from the public internet. If remote access is essential, use a VPN, MFA, and a restricted jump host.

3. Perform a credential review.
   Change legacy defaults, disable unused accounts, separate read-only monitoring from control privileges, and verify login timeout and lockout settings.

4. Harden the protocol configuration.
   Use HTTPS and SSHv2. Disable HTTP, Telnet, FTP, and SNMPv1/v2c. If SNMP is required, configure SNMPv3 with authentication and encryption, then restrict the permitted monitoring hosts.

5. Integrate the NMC into security operations.
   Forward logs to a central syslog server or SIEM where supported. Monitor failed logins, firmware changes, unexpected reboots, configuration changes, and new network connections. Synchronize time with NTP so events can be correlated accurately.

Vendor Considerations: APC, Schneider Electric, and CyberPower

APC by Schneider Electric provides detailed NMC3 security guidance covering TLS, SSH, SNMPv3, certificates, RADIUS, firewalls, user roles, and network segmentation. Its NMC3 Security Handbook recommends current firmware, TLS 1.2, custom certificates, default-deny firewall policies, and separation of management traffic from normal network traffic.

For APC Smart-UPS systems with cloud-enabled monitoring, security responsibilities do not disappear. For example, Ace Real Time Solutions lists the APC Smart-UPS 3000VA with SmartConnect as a solution for servers, switches, and high-demand IT networks. Cloud visibility should still be reviewed against corporate policies for identity, vendor access, data handling, and account administration.

CyberPower network cards vary significantly by product generation. Some older manuals document default web passwords, SNMPv1/v2c support, and remote control functions. Before deployment, confirm the exact model’s firmware, supported encryption, account behavior, SNMPv3 capabilities, and access-control options. Do not assume that a card supports the same security features as a newer enterprise UPS.

The same principle applies to other manufacturers, including Vertiv and Minuteman Technologies: obtain the current security documentation for the exact card and firmware combination, then apply a consistent organizational baseline.

Security Is Part of Power Protection

A UPS protects equipment from outages, sags, surges, and unstable power. Its network management card extends that protection by providing visibility and control. But remote visibility must be designed with the same discipline applied to servers, switches, firewalls, and building-control systems.

Secure management cards help organizations preserve uptime without creating an avoidable path into the network. They also create better data for proactive maintenance and AI-assisted anomaly detection, allowing teams to identify abnormal battery behavior, repeated power events, or unexpected configuration changes before they become an outage.

Ace Real Time Solutions designs and supports power protection systems for data centers, businesses, healthcare facilities, government organizations, and other critical environments. Visit our services page to learn more, review enterprise solution options, or contact our team to request a power audit, technical information, or a customized solution design.

Frequently Asked Questions

What is a UPS network management card?

A UPS network management card is a hardware or embedded interface that connects an uninterruptible power supply to a data network. It enables authorized users and monitoring platforms to view power status, receive alarms, collect logs, update configurations, and sometimes control shutdown or restart functions remotely.

How does a UPS network management card become a security risk?

An NMC becomes a security risk when it uses default credentials, outdated firmware, insecure protocols, excessive privileges, or unrestricted network access. Because the card may control UPS settings and connected load segments, a compromised interface can affect equipment availability and operational continuity.

How does SNMPv3 improve UPS monitoring security?

SNMPv3 adds authentication and encryption to UPS monitoring traffic. When configured with strong credentials, authenticated-and-private access, and firewall restrictions, it protects management data more effectively than SNMPv1 or SNMPv2c. SNMPv3 should still be disabled if monitoring does not require it, and write access should be limited or removed whenever possible.