Critical SEVD-2022-347-01 4 CVEs

APC Easy UPS Online Monitoring Software

Published Dec 13, 2022 · Updated Jan 11, 2023 · Revision 2

Vendor: Schneider Electric Product: APC Easy UPS Online Monitoring Software Product: APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022) Product: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 Windows Server 2016, 2019, 2022) Product: Easy UPS Online Monitoring Software Product: Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022) Product: Easy UPS Online Monitoring Software (Windows 7, 10, 11 Windows Server 2016, 2019, 2022)

Summary

Schneider Electric is aware of multiple vulnerabilities in its APC Easy UPS Online Monitoring Software.
The APC Easy UPS Online Monitoring Software is used to configure and manage APC Easy UPS.
Failure to apply the remediations provided below may risk remote code execution, escalation of privileges, or authentication bypass, which could result in execution of malicious web code or loss of device functionality.

Vulnerabilities 4

Critical 9.8

CVE-2022-42970

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functional…

Schneider Electric Schneider Electric Easy UPS Online Monitoring Software APC Easy UPS Online Monitoring Software ICS / OT

Feb 1, 2023
Critical 9.8

CVE-2022-42971

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution …

Schneider Electric APC Easy UPS Online Monitoring Software Schneider Electric Easy UPS Online Monitoring Software ICS / OT

Feb 1, 2023
High 7.8

CVE-2022-42972

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege …

Schneider Electric Schneider Electric Easy UPS Online Monitoring Software APC Easy UPS Online Monitoring Software ICS / OT

Feb 1, 2023
High 7.8

CVE-2022-42973

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local at…

Schneider Electric APC Easy UPS Online Monitoring Software Schneider Electric Easy UPS Online Monitoring Software ICS / OT

Feb 1, 2023

Revision history

2023-01-11 #2
Schneider Electric Easy UPS Online Monitoring Software was added to the list of impacted products, and remediation links were updated.
2022-12-13 #1
Original Release

References

APC Easy UPS Online Monitoring Software - SEVD-2022-347-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/