CVE-2022-42970

published 2023-02-01

CVE-2022-42970: A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)

Affected

8 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	apc_easy_ups_online_monitoring_software	< 2.5-ga-01-22320	2.5-ga-01-22320
schneider-electric	apc_easy_ups_online_monitoring_software	< 2.5-ga	2.5-ga
schneider-electric	easy_ups_online_monitoring_software	< 2.5-gs-01-22320	2.5-gs-01-22320
schneider-electric	easy_ups_online_monitoring_software	< 2.5-gs	2.5-gs
schneider_electric	apc_easy_ups_online_monitoring_software	>= (Windows 11, Windows Server 2019, 2022 < V2.5-GA-01-22261	V2.5-GA-01-22261
schneider_electric	apc_easy_ups_online_monitoring_software	>= Windows 7, 10, 11 Windows Server 2016, 2019, 2022 < V2.5-GA	V2.5-GA
schneider_electric	schneider_electric_easy_ups_online_monitoring_software	>= Windows 11, Windows Server 2019, 2022 < V2.5-GS-01-22261	V2.5-GS-01-22261
schneider_electric	schneider_electric_easy_ups_online_monitoring_software	>= Windows 7, 10, 11 Windows Server 2016, 2019, 2022 < V2.5-GS	V2.5-GS

CWE-306