CVE-2022-0715 CRITICAL

Published: 2022-03-09 | Last Modified: 2026-05-29 | Status: Modified

Description

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

Additional Descriptions (1)

Una CWE-287: Se presenta una vulnerabilidad de autenticación inapropiada que podría causar que un atacante cambie arbitrariamente el comportamiento del SAI cuando es filtrada una clave y es usada para cargar firmware malicioso. Producto afectado: Familia de Smart-UPS de APC: Serie SMT (SMT Series ID=18: UPS versiones 09.8 y anteriores / SMT Series ID=1040: UPS versiones 01.2 y anteriores / SMT Series ID=1031: UPS versiones 03.1 y anteriores), SMC Series (SMC Series ID=1005: UPS versiones 14.1 y anteriores / SMC Series ID=1007: UPS versiones 11.0 y anteriores / SMC Series ID=1041: UPS versiones 01.1 y anteriores), SCL Series (SCL Series ID=1030: UPS versiones 02.5 y anteriores / SCL Series ID=1036: UPS versiones 02.5 y anteriores), SMX Series (SMX Series ID=20: UPS versiones 10.2 y anteriores / SMX Series ID=23: UPS versiones 07.0 y anteriores), SRT Series (SRT Series ID=1010/1019/1025: UPS versiones 08.3 y anteriores / SRT Series ID=1024: UPS versiones 01.0 y anteriores / SRT Series ID=1020: UPS versiones 10.4 y anteriores / SRT Series ID=1021: UPS versiones 12.2 y anteriores / SRT Series ID=1001/1013: UPS versiones 05.1 y anteriores / SRT Series ID=1002/1014: UPS versiones a05.2 y anteriores), Familia SmartConnect de APC: Serie SMT (Serie SMT ID=1015: UPS versiones 04.5 y anteriores), Serie SMC (Serie SMC ID=1018: UPS versiones 04.2 y anteriores), Serie SMTL (Serie SMTL ID=1026: UPS versiones 02.9 y anteriores), Serie SCL (Serie SCL ID=1029: UPS versiones 02.5 y anteriores / SCL Series ID=1030: UPS versiones 02.5 y anteriores / SCL Series ID=1036: UPS versiones 02.5 y anteriores / SCL Series ID=1037: UPS versiones 03.1 y anteriores), SMX Series (SMX Series ID=1031: UPS versiones 03.1 y anteriores)

CVSS Metrics

Base Score: 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.2

Base Score: 6.4 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:P/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	NONE
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 4.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-287
[email protected]	Primary	en CWE-345

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	smt_series_1015_ups_firmware	*	<built-in method update of dict object at 0x7e613c3a9600>	Operating System
schneider-electric	smc_series_1018_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb6880>	Operating System
schneider-electric	smtl_series_1026_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb49c0>	Operating System
schneider-electric	scl_series_1029_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb5dc0>	Operating System
schneider-electric	scl_series_1030_ups_firmware	*	<built-in method update of dict object at 0x7e60b85ef400>	Operating System
schneider-electric	scl_series_1036_ups_firmware	*	<built-in method update of dict object at 0x7e60bae0ec80>	Operating System
schneider-electric	scl_series_1037_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb7940>	Operating System
schneider-electric	smx_series_1031_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb4100>	Operating System
schneider-electric	smt_series_18_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb4c00>	Operating System
schneider-electric	smt_series_1040_ups_firmware	*	<built-in method update of dict object at 0x7e61079cae40>	Operating System
schneider-electric	smt_series_1031_ups_firmware	*	<built-in method update of dict object at 0x7e613c3a8540>	Operating System
schneider-electric	smc_series_1005_ups_firmware	*	<built-in method update of dict object at 0x7e613c3a8940>	Operating System
schneider-electric	smc_series_1007_ups_firmware	*	<built-in method update of dict object at 0x7e613c3aadc0>	Operating System
schneider-electric	smc_series_1041_ups_firmware	*	<built-in method update of dict object at 0x7e60ba792c40>	Operating System
schneider-electric	scl_series_1030_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb4e40>	Operating System
schneider-electric	scl_series_1036_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb4840>	Operating System
schneider-electric	smx_series_20_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb5440>	Operating System
schneider-electric	smx_series_23_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb4a00>	Operating System
schneider-electric	srt_series_1010_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb5cc0>	Operating System
schneider-electric	srt_series_1019_ups_firmware	*	<built-in method update of dict object at 0x7e60b9fb6f00>	Operating System
schneider-electric	srt_series_1025_ups_firmware	*	<built-in method update of dict object at 0x7e6107bcf240>	Operating System
schneider-electric	srt_series_1020_ups_firmware	*	<built-in method update of dict object at 0x7e60eb2185c0>	Operating System
schneider-electric	srt_series_1021_ups_firmware	*	<built-in method update of dict object at 0x7e61342e5f40>	Operating System
schneider-electric	srt_series_1001_ups_firmware	*	<built-in method update of dict object at 0x7e6110a9e900>	Operating System
schneider-electric	srt_series_1013_ups_firmware	*	<built-in method update of dict object at 0x7e6110a9dac0>	Operating System
schneider-electric	srt_series_1002_ups_firmware	*	<built-in method update of dict object at 0x7e6110a9db00>	Operating System
schneider-electric	srt_series_1014_ups_firmware	*	<built-in method update of dict object at 0x7e6110a9f680>	Operating System
schneider-electric	srtl1000rmxli_firmware	*	<built-in method update of dict object at 0x7e61342e6580>	Operating System
schneider-electric	srtl1000rmxli-nc_firmware	*	<built-in method update of dict object at 0x7e60bbd1a280>	Operating System
schneider-electric	srtl1500rmxli-nc_firmware	*	<built-in method update of dict object at 0x7e613c3160c0>	Operating System
schneider-electric	srtl1500rmxli_firmware	*	<built-in method update of dict object at 0x7e6112c99f40>	Operating System
schneider-electric	srtl2200rmxli_firmware	*	<built-in method update of dict object at 0x7e6110d41c80>	Operating System
schneider-electric	srtl2200rmxli-nc_firmware	*	<built-in method update of dict object at 0x7e60eb219440>	Operating System
schneider-electric	srtl3000rmxli-nc_firmware	*	<built-in method update of dict object at 0x7e6142a96a00>	Operating System
schneider-electric	srtl3000rmxli_firmware	*	<built-in method update of dict object at 0x7e60eb2daf80>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smt_series_1015_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smt_series_1015_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smc_series_1018_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smc_series_1018_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smtl_series_1026_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smtl_series_1026_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1029_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1029_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1030_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1030_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1036_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1036_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1037_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1037_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smx_series_1031_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smx_series_1031_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smt_series_18_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smt_series_18_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smt_series_1040_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smt_series_1040_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smt_series_1031_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smt_series_1031_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smc_series_1005_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smc_series_1005_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smc_series_1007_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smc_series_1007_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smc_series_1041_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smc_series_1041_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1030_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1030_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1036_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1036_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smx_series_20_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smx_series_20_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smx_series_23_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smx_series_23_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1010_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1010_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1019_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1019_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1025_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1025_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1020_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1020_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1021_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1021_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1001_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1001_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1013_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1013_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1002_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1002_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srt_series_1014_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srt_series_1014_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srtl1000rmxli_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srtl1000rmxli:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srtl1000rmxli-nc_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srtl1000rmxli-nc:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srtl1500rmxli-nc_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srtl1500rmxli-nc:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srtl1500rmxli_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srtl1500rmxli:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srtl2200rmxli_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srtl2200rmxli:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srtl2200rmxli-nc_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srtl2200rmxli-nc:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srtl3000rmxli-nc_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srtl3000rmxli-nc:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:srtl3000rmxli_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:srtl3000rmxli:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
Source: [email protected]

Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory