description:
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow
changes to administrative credentials, leading to potential remote code execution without
requiring prior authentication on the Java RMI interface.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
defaultStatus: unaffected
product: APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)
vendor: Schneider Electric
versions:
lessThanOrEqual: prior, status: affected, version: V2.5-GA-01-22320, versionType: custom
}
{
defaultStatus: unaffected
product: Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)
vendor: Schneider Electric
versions:
lessThanOrEqual: prior, status: affected, version: V2.5-GS-01-22320, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL