CVE-2023-29411 — Schneider Electric / APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)

Description (CNA)

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interface.

Affected (CNA)

Vendor / product	Versions
Schneider Electric / APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)	affected V2.5-GA-01-22320 through prior
Schneider Electric / Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)	affected V2.5-GS-01-22320 through prior

CWE

CWE-306

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf

ADP enrichment

CVE

No English description supplied.

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf

CISA-ADP

No English description supplied.

No references supplied.