PT-2022-6392 · Schneider Electric · Apc Easy Ups Online Monitoring+1

Published 2022-12-13 · Updated 2023-05-17 · CVE-2022-42973

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions APC Easy UPS Online Monitoring Software versions prior to V2.5-GA APC Easy UPS Online Monitoring Software versions prior to V2.5-GA-01-22261 Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS-01-22261

Description A Use of Hard-coded Credentials issue exists that could cause local privilege escalation when a local attacker connects to the database. This could allow an attacker to gain unauthorized access to the target system.

Recommendations For APC Easy UPS Online Monitoring Software versions prior to V2.5-GA, update to version V2.5-GA or later. For APC Easy UPS Online Monitoring Software versions prior to V2.5-GA-01-22261, update to version V2.5-GA-01-22261 or later. For Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS, update to version V2.5-GS or later. For Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS-01-22261, update to version V2.5-GS-01-22261 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2023-01151

CVE-2022-42973

ZDI-23-638

Affected Products

Apc Easy Ups Online Monitoring

Schneider Electric Easy Ups Online Monitoring

References · 10

• https://safe-surf.ru/upload/VULN/VULN-20221228.10.pdf · Security Note
• https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-638 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-42973 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42973 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01151 · Security Note
• https://t.me/cvenotify/43289 · Telegram Post
• https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf · Note
• https://vuldb.com/ru/?id.215451 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-22-347-02 · Note