CVE-2022-0715 — Improper Authentication in SCL Series 1029 UPS Firmware

CWE-287 — Improper AuthenticationCWE-345 — Insufficient Verification of Data Authenticity3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
1.1%
top 22.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
35
Schneider-electric SCL Series 1029 UPS FirmwareSchneider-electric SCL Series 1030 UPS FirmwareSchneider-electric SCL Series 1036 UPS Firmware+32 more
Timeline
PublishedMar 9
Latest updateMar 10

Description

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), S…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages35 packages

🔴Vulnerability Details

2
GHSA
GHSA-fxwp-hqgp-45qg: A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leake↗2022-03-10
▶
CVEList
CVE-2022-0715: A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leake↗2022-03-09
▶
CVE-2022-0715 — Improper Authentication | cvebase