PT-2022-5821 · Schneider Electric · Apc Easy Ups Online Monitoring+1

Published

2022-12-13

·

Updated

2023-05-17

·

CVE-2022-42970

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions APC Easy UPS Online Monitoring Software versions prior to V2.5-GA APC Easy UPS Online Monitoring Software versions prior to V2.5-GA-01-22261 Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS-01-22261
Description The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This issue is related to a missing authentication for critical function, which may allow a remote attacker to access the software.
Recommendations For APC Easy UPS Online Monitoring Software versions prior to V2.5-GA, update to version V2.5-GA or later. For APC Easy UPS Online Monitoring Software versions prior to V2.5-GA-01-22261, update to version V2.5-GA-01-22261 or later. For Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS, update to version V2.5-GS or later. For Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS-01-22261, update to version V2.5-GS-01-22261 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-07227
CVE-2022-42970
ZDI-23-636

Affected Products

Apc Easy Ups Online Monitoring
Schneider Electric Easy Ups Online Monitoring