Lucene search

[email protected]CVE-2022-42970

HistoryFeb 01, 2023 - 4:15 a.m.

CVE-2022-42970

2023-02-0104:15:08

CWE-306

[email protected]

web.nvd.nist.gov

cve-2022-42970

cwe-306

missing authentication

critical function

apc

schneider electric

easy ups

monitoring software

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.6%

JSON

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)

Affected configurations

NVD

Node

microsoftwindows_11Match--

microsoftwindows_server_2019Match-

microsoftwindows_server_2022Match-

AND

schneider-electricapc_easy_ups_online_monitoring_softwareRange<2.5-ga-01-22320

Node

microsoftwindows_11Match--

microsoftwindows_server_2019Match-

microsoftwindows_server_2022Match-

AND

schneider-electriceasy_ups_online_monitoring_softwareRange<2.5-gs-01-22320

Node

microsoftwindows_10Match--

microsoftwindows_11Match--

microsoftwindows_7Match-

microsoftwindows_server_2016Match-

microsoftwindows_server_2019Match-

microsoftwindows_server_2022Match-

AND

schneider-electricapc_easy_ups_online_monitoring_softwareRange<2.5-ga

Node

microsoftwindows_10Match--

microsoftwindows_11Match--

microsoftwindows_7Match-

microsoftwindows_server_2016Match-

microsoftwindows_server_2019Match-

microsoftwindows_server_2022Match-

AND

schneider-electriceasy_ups_online_monitoring_softwareRange<2.5-gs

CPENameOperatorVersion
schneider-electric:apc_easy_ups_online_monitoring_softwareschneider-electric apc easy ups online monitoring softwarelt2.5-ga-01-22320

CPE	Name	Operator	Version
schneider-electric:apc_easy_ups_online_monitoring_software	schneider-electric apc easy ups online monitoring software	lt	2.5-ga-01-22320

CNA Affected

[
  {
    "vendor": "Schneider Electric",
    "product": "APC Easy UPS Online Monitoring Software",
    "versions": [
      {
        "version": "Windows 7, 10, 11 Windows Server 2016, 2019, 2022",
        "status": "affected",
        "lessThan": "V2.5-GA",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "APC Easy UPS Online Monitoring Software",
    "versions": [
      {
        "version": "(Windows 11, Windows Server 2019, 2022",
        "status": "affected",
        "lessThan": "V2.5-GA-01-22261",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "Schneider Electric Easy UPS Online Monitoring Software",
    "versions": [
      {
        "version": "Windows 7, 10, 11 Windows Server 2016, 2019, 2022",
        "status": "affected",
        "lessThan": "V2.5-GS",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "Schneider Electric Easy UPS Online Monitoring Software",
    "versions": [
      {
        "version": "Windows 11, Windows Server 2019, 2022",
        "status": "affected",
        "lessThan": "V2.5-GS-01-22261",
        "versionType": "custom"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf