Schneider Electric Smtl Series 1026 Ups Firmware vulnerabilities

3 CVEs affecting Schneider Electric Smtl Series 1026 Ups Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22806, published 2022-03-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22806, published 2022-03-09. Critical severity, CVSS 9.8. EPSS: 12.5% chance of exploitation in the next 30 days. A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect…
CVE-2022-22805, published 2022-03-09. Critical severity, CVSS 9.8. EPSS: 11.9% chance of exploitation in the next 30 days. A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled.…
CVE-2022-0715, published 2022-03-09. Critical severity, CVSS 9.1. EPSS: 5.8% chance of exploitation in the next 30 days. A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected…