PT-2023-2350 · Schneider Electric · Apc Easy Ups Online Monitoring+1

Published

2023-04-11

·

Updated

2024-06-12

·

CVE-2023-29412

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions APC Easy UPS Online Monitoring Software versions (affected versions not specified) Schneider Electric APC Easy UPS Online (affected versions not specified)
Description A vulnerability exists due to improper neutralization of special elements used in an OS command, which could cause remote code execution when manipulating internal methods through the Java RMI interface. This issue may allow a remote attacker to execute arbitrary code.
Recommendations For APC Easy UPS Online Monitoring Software, restrict access to the Java RMI interface until a patch is available. For Schneider Electric APC Easy UPS Online, avoid using the getMacAddressByIP function until the issue is resolved. As a temporary workaround, consider disabling the Java RMI interface to minimize the risk of exploitation.

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-02117
CVE-2023-29412
ZDI-23-445

Affected Products

Apc Easy Ups On-Line
Apc Easy Ups Online Monitoring