Data center cyber-physical system vulnerabilities

Security research has highlighted significant vulnerabilities within the cyber-physical systems (CPS) that support global data center infrastructure. Initial findings identified specific critical weaknesses in Vertiv uninterruptible power supplies (UPS) that could lead to total power loss, as well as exploitable bugs in Trane Tracer SC+ HVAC controllers allowing remote code execution. Additionally, researchers uncovered 15 unknown vulnerabilities in TP-Link Omada’s Zero-Touch Provisioning system, which could allow attackers to gain control over network controllers and cloud services.

Subsequent analysis by Claroty, titled ‘State of CPS Security: Data Center Exposures’, expanded on these risks by examining over 750,000 CPS components. The report found that one in five systems, including HVAC and UPS, possess serious flaws. The study noted that 41% of power distribution units and 32% of HVAC/cooling systems are either directly internet-exposed or nearly so. Furthermore, 88% of building management systems are exposed via insecure protocols, and a significant portion of operational technology (OT) and IoT systems rely on obsolete protocols such as BACnet and MODBUS.