Description
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulnerability exists that could cause arbitrary file deletion upon service restart when accessed by
a local and low-privileged attacker.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Easy UPS Online Monitoring Software | 2.6-GA-01-23116 and prior (Windows 10, 11, Windows Server 2016, 2019, 2022) | — |
Advisories 2
- ICSA-23-346-01 Schneider Electric Easy UPS Online Monitoring Software CISA ICS & IT advisories · Dec 12, 2023
- SEVD-2023-346-03 Easy UPS Online Monitoring Software Schneider Electric CPCERT · Dec 12, 2023