To be clear, I'm not saying the software is malware or is infected.

I had an extended power outage at home today during which nearly all my UPSes ran dry. After powering everything back on, I kept getting emails from 2 of my PowerChute instances that they had insufficient run times. Worried that their batteries might be toast, I logged into the web UIs, only to find PowerChute needed an update.

I downloaded the update and double-clicked the installer. I was surprised to see the UAC prompt that popped up indicate the binary is unsigned. As I do for all such installers, I uploaded it to VirusTotal. There were no detections, but there are no less than 5 YARA and Sigma rule matches.

This led me to search for CVEs, which produced this list of 11 issues, 4 of which are in the past 2 years.

I really like APC UPSes and PowerChute itself, so I'd rather keep them. I also think it would be great if we could get some attention on this so they can improve the security of their software.