Critical ICSA-22-347-02 4 CVEs

Schneider Electric APC Easy UPS Online

Published Dec 13, 2022 · Updated Dec 13, 2022

Vendor: Schneider Electric Product: APC Easy UPS Online

Summary

Successful exploitation of these vulnerabilities could result in unauthenticated remote code execution, unauthenticated password changes, and escalation of privileges.

Vulnerabilities 4

Critical 9.8

CVE-2022-42970

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functional…

Schneider Electric Schneider Electric Easy UPS Online Monitoring Software APC Easy UPS Online Monitoring Software ICS / OT

Feb 1, 2023
Critical 9.8

CVE-2022-42971

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution …

Schneider Electric APC Easy UPS Online Monitoring Software Schneider Electric Easy UPS Online Monitoring Software ICS / OT

Feb 1, 2023
High 7.8

CVE-2022-42972

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege …

Schneider Electric Schneider Electric Easy UPS Online Monitoring Software APC Easy UPS Online Monitoring Software ICS / OT

Feb 1, 2023
High 7.8

CVE-2022-42973

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local at…

Schneider Electric APC Easy UPS Online Monitoring Software Schneider Electric Easy UPS Online Monitoring Software ICS / OT

Feb 1, 2023

Revision history

2022-12-13 #1
Publication Date

References

ICS Advisory ICSA-22-347-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-347-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf