CVE-2022-42972
Description
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
How to fix
- schneider-electric easy_ups_online_monitoring_software2.5-gs-01-22320, 2.5-gs or later
- schneider-electric apc_easy_ups_online_monitoring_software2.5-ga-01-22320, 2.5-ga or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric easy_ups_online_monitoring_software | v < 2.5-gs-01-22320, v < 2.5-gs | 2.5-gs-01-22320, 2.5-gs |
| schneider-electric apc_easy_ups_online_monitoring_software | v < 2.5-ga-01-22320, v < 2.5-ga | 2.5-ga-01-22320, 2.5-ga |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.