Severity
High
Analysis Summary
CVE-2022-0715
Schneider Electric APC Smart-UPS uninterruptable power supply devices could allow a remote attacker to bypass security restrictions, caused by a design flaw. An attacker could exploit this vulnerability to arbitrarily change the behavior of the UPS if a key is leaked and used to upload malicious firmware. Note: This vulnerability is known as TLStorm.
CVE-2022-22806
Schneider Electric APC Smart-UPS uninterruptable power supply devices could allow a remote attacker to bypass security restrictions, caused by a Capture-replay vulnerability. By sending a malformed connection, an attacker could exploit this vulnerability to cause an unauthenticated connection to the UPS. Note: This vulnerability is known as TLStorm.
Impact
- Security Bypass
Indicators Of Compromise
CVE
- CVE-2022-0715
- CVE-2022-22806
Affected Vendors
Schneider Electric
Affected Products
- Schneider Electric SMT Series 1015 UPS 04.5
- Schneider Electric SMC Series 1018 UPS 04.2
- Schneider Electric SMTL Series 1026 UPS 02.9
- Schneider Electric SCL Series 1029 UPS 02.5
Remediation
Refer to Schneider Electric for patch, upgrade or suggested workaround information.