Schneider Electric APC Smart-UPS security bypass | CVE-2022-0715
NAME
Schneider Electric APC Smart-UPS security bypass
- Platforms Affected:
Schneider Electric SMT Series 1015 UPS 04.5
Schneider Electric SMC Series 1018 UPS 04.2
Schneider Electric SMTL Series 1026 UPS 02.9
Schneider Electric SCL Series 1029 UPS 02.5
Schneider Electric SCL Series 1036 UPS 02.5
Schneider Electric SCL Series 1037 UPS 03.1
Schneider Electric SMX Series 1031 UPS 03.1
Schneider Electric SCL Series 1030 UPS 02.5
Schneider Electric SMX Series 20 UPS 10.2
Schneider Electric SMX Series 23 UPS 07.0
Schneider Electric SRT Series 1010 UPS 08.3
Schneider Electric SRT Series 1019 UPS 08.3
Schneider Electric SRT Series 1025 UPS 08.3
Schneider Electric SRT Series 1024 UPS 01.0
Schneider Electric SRT Series 1020 UPS 10.4
Schneider Electric SRT Series 1021 UPS 12.2
Schneider Electric SRT Series 1001 UPS 05.1
Schneider Electric SRT Series 1013 UPS 05.1
Schneider Electric SRT Series 1002 UPSa05.2
Schneider Electric SRT Series 1014 UPSa05.2 - Risk Level:
8.9 - Exploitability:
Unproven - Consequences:
Bypass Security
DESCRIPTION
Schneider Electric APC Smart-UPS uninterruptable power supply devices could allow a remote attacker to bypass security restrictions, caused by a design flaw. An attacker could exploit this vulnerability to arbitrarily change the behavior of the UPS if a key is leaked and used to upload malicious firmware. Note: This vulnerability is known as TLStorm.
CVSS 3.0 Information
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Access Vector: Network
- Access Complexity: High
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: High
- Remediation Level: Official Fix
MITIGATION
Refer to Schneider Electric SEVD-2022-067-02 for patch, upgrade or suggested workaround information. See References.
- Reference Link:
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-02 - Reference Link:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0715
If you like the site, please consider joining the telegram channel and supporting us on Patreon using the button below.
