Description
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow
changes to administrative credentials, leading to potential remote code execution without
requiring prior authentication on the Java RMI interface.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) | V2.5-GA-01-22320 – ≤ prior | — |
| Schneider Electric | Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) | V2.5-GS-01-22320 – ≤ prior | — |
Advisories 2
- ICSA-23-108-02 Schneider Electric APC Easy UPS Online Monitoring Software (Update A) CISA ICS & IT advisories · Jun 11, 2024
- SEVD-2023-101-04 Easy UPS Online Monitoring Software Schneider Electric CPCERT · Jun 11, 2024