APC Easy UPS On-Line Software

Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-04 Page 1 of 4 ## APC Easy UPS On-Line Software 11 August 2020 ## Overview Schneider Electric is aware of multiple vulnerabilities in the APC Easy UPS On-Line Software, which may lead to the uploading of executable files to non-specified directories by an unauthorized user. ## Affected Product(s) SFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier ## Vulnerability Details CVE ID: CVE-2020-7521 CVSS v3.0 Base Score 9.8 | Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists when accessing a vulnerable method of `FileUploadServlet` which may lead to uploading executable files to non-specified directories. CVE ID: CVE-2020-7522 CVSS v3.0 Base Score 9.8 | Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability occurs when accessing a vulnerable method of `SoundUploadServlet` which may lead to uploading executable files to non-specified directories. ## Remediation The vulnerabilities are fixed in V2.1 which is available for download below: https://www.se.com/ww/en/product/SFAPV9601/apc-easy-ups-online-software/ The following workarounds and mitigations can be applied by customers to reduce the risk: • Utilize application whitelisting software. Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-04 Page 2 of 4 • Utilize firewall rules to limit network access to only those intended to connect. • Update to V2.1 as soon as possible. Reboot if required at the end of the software installation. ## Product Information Software for use with APC Easy UPS On-Line products. Product Category - Critical Power, Cooling and Racks