CVE-2022-22805 CRITICAL

Published: 2022-03-09 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

Additional Descriptions (1)

Existe una vulnerabilidad CWE-120: Copia del búfer sin comprobar el tamaño de la entrada ('Desbordamiento clásico del búfer') que podría causar la ejecución remota de código cuando se reensambla un paquete TLS mal gestionado. Producto afectado: Familia SmartConnect: Serie SMT (SMT Series ID=1015: UPS 04.5 y anteriores), Serie SMC (SMC Series ID=1018: UPS 04.2 y anteriores), Serie SMTL (SMTL Series ID=1026: UPS 02.9 y anteriores), Serie SCL (SCL Series ID=1029: UPS 02. 5 y anteriores / SCL Series ID=1030: UPS 02.5 y anteriores / SCL Series ID=1036: UPS 02.5 y anteriores / SCL Series ID=1037: UPS 03.1 y anteriores), SMX Series (SMX Series ID=1031: UPS 03.1 y anteriores)

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Base Score: 7.5 (HIGH)

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 6.4

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-120
[email protected]	Secondary	en CWE-120

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	smt_series_1015_ups_firmware	*	<built-in method update of dict object at 0x7e6111c1d0c0>	Operating System
schneider-electric	smc_series_1018_ups_firmware	*	<built-in method update of dict object at 0x7e6112394c80>	Operating System
schneider-electric	smtl_series_1026_ups_firmware	*	<built-in method update of dict object at 0x7e60a8897380>	Operating System
schneider-electric	scl_series_1029_ups_firmware	*	<built-in method update of dict object at 0x7e6111c1f400>	Operating System
schneider-electric	scl_series_1030_ups_firmware	*	<built-in method update of dict object at 0x7e6111c1f640>	Operating System
schneider-electric	scl_series_1036_ups_firmware	*	<built-in method update of dict object at 0x7e60bafaf5c0>	Operating System
schneider-electric	scl_series_1037_ups_firmware	*	<built-in method update of dict object at 0x7e60bafafdc0>	Operating System
schneider-electric	smx_series_1031_ups_firmware	*	<built-in method update of dict object at 0x7e60a8894cc0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smt_series_1015_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smt_series_1015_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smc_series_1018_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smc_series_1018_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smtl_series_1026_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smtl_series_1026_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1029_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1029_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1030_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1030_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1036_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1036_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scl_series_1037_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:scl_series_1037_ups:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:smx_series_1031_ups_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:smx_series_1031_ups:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
Source: [email protected]

Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory