by Kastro
Paper/Archive/CVE-2023-29411

CVE-2023-29411

Schneider Electric APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) — A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, lead…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.8.708 × 2014.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interface.

Affected

ProductAffectedFixed inSource
APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)V2.5-GA-01-22320 – prior–CNA
Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)V2.5-GS-01-22320 – prior–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
schneider (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdownload.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf