PT-2022-1801 · Apc · Apc Smart-Ups Smc Series+1

Published

2022-03-08

·

Updated

2024-10-21

·

CVE-2022-22806

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions APC Smart-UPS SMT Series versions 04.5 and prior APC Smart-UPS SMC Series versions 04.2 and prior APC Smart-UPS SMTL Series versions 02.9 and prior APC Smart-UPS SCL Series versions 02.5 and prior APC Smart-UPS SCL Series versions 03.1 and prior APC Smart-UPS SMX Series versions 03.1 and prior
Description A vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. This issue is related to errors during the authentication procedure, which may allow a remote attacker to execute arbitrary code.
Recommendations For SMT Series versions 04.5 and prior, update to a version later than 04.5 to resolve the issue. For SMC Series versions 04.2 and prior, update to a version later than 04.2 to resolve the issue. For SMTL Series versions 02.9 and prior, update to a version later than 02.9 to resolve the issue. For SCL Series versions 02.5 and prior, update to a version later than 02.5 to resolve the issue. For SCL Series versions 03.1 and prior, update to a version later than 03.1 to resolve the issue. For SMX Series versions 03.1 and prior, update to a version later than 03.1 to resolve the issue. As a temporary workaround, consider restricting access to the UPS to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

BDU:2022-01212
CVE-2022-22806

Affected Products

Apc Smart-Ups Scl Series
Apc Smart-Ups Smc Series