CyberSecBulletin
CVE-2022-0715NVD status: Modified

APC Smart-UPS: Insufficient Verification of Data Authenticity

Published Updated By the CyberSecBulletin desk

CVE-2022-0715 is a critical-severity insufficient verification of data authenticity vulnerability in APC Smart-UPS from Schneider Electric, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected APC Smart-UPS versions: SMT Series; SMC Series; SCL Series, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 5.96% chance of exploitation within 30 days, which is in the top 6.59% of all scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Check which version of APC Smart-UPS you run against the affected versions below, and install the vendor's latest release.
  2. Read the advisory on se.com for workarounds and exact fixed builds.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Schneider ElectricAPC Smart-UPSSMT Series; SMC Series; SCL Series; SMX Series; SRT SeriesNot stated
Schneider ElectricSmartConnectSMT Series; SMC Series; SMTL Series; SCL Series; SMX SeriesNot stated
Schneider ElectricSmt Series 1015 Ups Firmware04.5 and earlierNot stated
Schneider ElectricSmc Series 1018 Ups Firmware04.2 and earlierNot stated
Schneider ElectricSmtl Series 1026 Ups Firmware02.9 and earlierNot stated
Schneider ElectricScl Series 1029 Ups Firmware02.5 and earlierNot stated
Schneider ElectricScl Series 1030 Ups Firmware02.5 and earlierNot stated
Schneider ElectricScl Series 1036 Ups Firmware02.5 and earlierNot stated
Schneider ElectricScl Series 1037 Ups Firmware03.1 and earlierNot stated
Schneider ElectricSmx Series 1031 Ups Firmware03.1 and earlierNot stated
Schneider ElectricSmt Series 18 Ups Firmware09.8 and earlierNot stated
Schneider ElectricSmt Series 1040 Ups Firmware01.2 and earlierNot stated
Schneider ElectricSmt Series 1031 Ups Firmware03.1 and earlierNot stated
Schneider ElectricSmc Series 1005 Ups Firmware14.1 and earlierNot stated
Schneider ElectricSmc Series 1007 Ups Firmware11.0 and earlierNot stated
Schneider ElectricSmc Series 1041 Ups Firmware01.1 and earlierNot stated
Schneider ElectricSmx Series 20 Ups Firmware10.2 and earlierNot stated
Schneider ElectricSmx Series 23 Ups Firmware07.0 and earlierNot stated
Schneider ElectricSrt Series 1010 Ups Firmware08.3 and earlierNot stated
Schneider ElectricSrt Series 1019 Ups Firmware08.3 and earlierNot stated
Schneider ElectricSrt Series 1025 Ups Firmware08.3 and earlierNot stated
Schneider ElectricSrt Series 1020 Ups Firmware10.4 and earlierNot stated
Schneider ElectricSrt Series 1021 Ups Firmware12.2 and earlierNot stated
Schneider ElectricSrt Series 1001 Ups Firmware05.1 and earlierNot stated
Schneider ElectricSrt Series 1013 Ups Firmware05.1 and earlierNot stated

Version data comes from the organisation that assigned the CVE; 10 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.19.1CriticalNVD
CVSS 3.18.9HighCISA (ADP)
CVSS 2.06.4MediumNVD

Official description

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

More Insufficient Verification of Data Authenticity vulnerabilities (CWE-345)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Insufficient Verification of Data Authenticity vulnerabilities

Spotted an error? Tell us.