Schneider Electric Easy Ups Online Monitoring Software vulnerabilities

8 CVEs affecting Schneider Electric Easy Ups Online Monitoring Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6407, published 2023-12-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-29411, published 2023-04-18. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring…
CVE-2023-29412, published 2023-04-18. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when manipulating internal methods…
CVE-2022-42971, published 2023-02-01. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS…
CVE-2022-42970, published 2023-02-01. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of…
CVE-2023-29413, published 2023-04-18. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor service.
CVE-2023-6407, published 2023-12-14. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file deletion upon service restart when accessed by a local…
CVE-2022-42972, published 2023-02-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected…
CVE-2022-42973, published 2023-02-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affected Products: APC Easy UPS Online…