PT-2023-2207 · Oracle+1 · Java Rmi Interface+1

Published 2023-04-11 · Updated 2023-04-28 · CVE-2023-29411

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions APC Easy UPS Online Monitoring Software versions (affected versions not specified) Java RMI interface versions (affected versions not specified)

Description The issue is related to a lack of authentication for a critical function, which could allow an attacker to change administrative credentials, potentially leading to remote code execution without prior authentication on the Java RMI interface.

Recommendations For APC Easy UPS Online Monitoring Software, update the software to a version that includes authentication for critical functions. For Java RMI interface, restrict access to the interface until a patch is available that includes proper authentication for critical functions. As a temporary workaround, consider disabling the updateManagerPassword function until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-01954

CVE-2023-29411

ZDI-23-444

Affected Products

Apc Easy Ups Online Monitoring

Java Rmi Interface

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-29411 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-444 · Security Note
• https://bdu.fstec.ru/vul/2023-01954 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29411 · Vendor Advisory
• https://t.me/cvenotify/49309 · Telegram Post
• https://t.me/cvenotify/48526 · Telegram Post
• https://t.me/cibsecurity/62402 · Telegram Post
• https://t.me/true_secator/4321 · Telegram Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf · Note