CVE-2022-0715
Description
A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric smtl_series_1026_ups_firmware | v ≤ 02.9 | — |
| schneider-electric smt_series_1015_ups_firmware | v ≤ 04.5 | — |
| schneider-electric smc_series_1018_ups_firmware | v ≤ 04.2 | — |
| schneider-electric scl_series_1029_ups_firmware | v ≤ 02.5 | — |
| schneider-electric scl_series_1030_ups_firmware | v ≤ 02.5 | — |
| schneider-electric scl_series_1036_ups_firmware | v ≤ 02.5 | — |
| schneider-electric scl_series_1037_ups_firmware | v ≤ 03.1 | — |
| schneider-electric smx_series_1031_ups_firmware | v ≤ 03.1 | — |
| schneider-electric smt_series_18_ups_firmware | v ≤ 09.8 | — |
| schneider-electric smt_series_1040_ups_firmware | v ≤ 01.2 | — |
| schneider-electric smt_series_1031_ups_firmware | v ≤ 03.1 | — |
| schneider-electric smc_series_1005_ups_firmware | v ≤ 14.1 | — |
| schneider-electric smc_series_1007_ups_firmware | v ≤ 11.0 | — |
| schneider-electric smc_series_1041_ups_firmware | v ≤ 01.1 | — |
| schneider-electric smx_series_20_ups_firmware | v ≤ 10.2 | — |
| schneider-electric smx_series_23_ups_firmware | v ≤ 07.0 | — |
| schneider-electric srt_series_1010_ups_firmware | v ≤ 08.3 | — |
| schneider-electric srt_series_1019_ups_firmware | v ≤ 08.3 | — |
| schneider-electric srt_series_1025_ups_firmware | v ≤ 08.3 | — |
| schneider-electric srt_series_1020_ups_firmware | v ≤ 10.4 | — |
| schneider-electric srt_series_1021_ups_firmware | v ≤ 12.2 | — |
| schneider-electric srt_series_1001_ups_firmware | v ≤ 05.1 | — |
| schneider-electric srt_series_1013_ups_firmware | v ≤ 05.1 | — |
| schneider-electric srt_series_1002_ups_firmware | v ≤ a05.2 | — |
| schneider-electric srt_series_1014_ups_firmware | v ≤ a05.2 | — |
| schneider-electric srtl1000rmxli_firmware | v ≤ 01.0 | — |
| schneider-electric srtl1000rmxli-nc_firmware | v ≤ 01.0 | — |
| schneider-electric srtl1500rmxli-nc_firmware | v ≤ 01.0 | — |
| schneider-electric srtl1500rmxli_firmware | v ≤ 01.0 | — |
| schneider-electric srtl2200rmxli_firmware | v ≤ 01.0 | — |
| schneider-electric srtl2200rmxli-nc_firmware | v ≤ 01.0 | — |
| schneider-electric srtl3000rmxli-nc_firmware | v ≤ 01.0 | — |
| schneider-electric srtl3000rmxli_firmware | v ≤ 01.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.