by Kastro
Paper/Archive/CVE-2023-29412

CVE-2023-29412

Schneider Electric APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) — CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause…

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.8.688 × 2013.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when manipulating internal methods through Java RMI interface.

Affected

ProductAffectedFixed inSource
APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)V2.5-GA-01-22320 – prior–CNA
Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)V2.5-GS-01-22320 – prior–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
schneider (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdownload.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf