IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2023-101-04 — Easy UPS Online Monitoring Software

CRITICAL
CVSS 9.8
Date 2026-10-16T20:34:43+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 11-Apr-23 (11-Jun-24) Document Reference Number – SEVD-2023-101-04 (v4.0.0) Page 1 of 6 ## Easy UPS Online Monitoring Software 11 April 2023 (11 June 2024) # Overview Schneider Electric is aware of multiple vulnerabilities in its Easy UPS Online Monitoring Software, known as APC Easy UPS Online Monitoring Software, and Schneider Electric UPS Online Monitoring Software known as Schneider SP Series UPS Online Monitoring Software in China. The Easy UPS Online Monitoring Software is used to configure and manage Easy UPS products. Failure to apply the remediations provided below may risk remote code execution, escalation of privileges, or authentication bypass, which could result in execution of malicious web code or loss of device functionality. June 2024 Update: Vulnerability description for CVE-2023-29412 has been updated. CWE-78 is correct, but the initial description didn’t match with this CWE ID. Remediation instructions were updated to clarify support status. # Affected Product and Versions Product Version APC Easy UPS Online Monitoring Software v2.5-GA-01-22320 and prior (Windows 10, 11 Windows Server 2016, 2019, 2022) Schneider Electric Easy UPS Online Monitoring Software* > *Known as Schneider SP Series UPS Monitoring Software in China. v2.5-GS-01-22320 and prior (Windows 10, 11 Windows Server 2016, 2019, 2022) Schneider Electric Security Notification 11-Apr-23 (11-Jun-24) Document Reference Number – SEVD-2023-101-04 (v4.0.0) Page 2 of 6 # Vulnerability Details CVE ID: CVE-2023-29411 CVSS v3.1 Base Score 9.8 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interface. CVE ID: CVE-2023-29412

// Vulnerabilities (3)

CVE ID CVSS Score Severity Description
CVE-2023-29413 9.8 critical
A vulnerability exists that could cause a denial-of-service condition when accessed by an unauthenticated user on the Schneider UPS Monitor service.
CVE-2023-29412 9.8 critical
Prior versions of Schneider Electric APC Easy UPS Online contain an OS Command Injection vulnerability that could cause remote code execution when manipulating internal methods through Java RMI interface.
CVE-2023-29411 9.8 critical
A vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interface.

// Remediations (20)

Mitigation: PowerChute Serial Shutdown
PowerChute Serial Shutdown
Mitigation: The affected software is being discontinued with the discontinuation of the Easy UPS Online SNMP Car
The affected software is being discontinued with the discontinuation of the Easy UPS Online SNMP Cards (APV9601, APVS9601) managed by this software. Fixed versions notwithstanding, Schneider Electric recommends users to migrate to the PowerChute series of software, including PowerChute Serial Shutdown and PowerChute Network Shutdown. For more information, please see the following sites:
Patch: Schneider Electric Easy UPS Online Monitoring Software: Version 2.6-GS or later
Schneider Electric Easy UPS Online Monitoring Software: Version 2.6-GS or later
Mitigation: Schneider Electric strongly recommends users follow cybersecurity industry best practices, including
Schneider Electric strongly recommends users follow cybersecurity industry best practices, including:
Mitigation: Schneider Electric recommends users update their affected devices to the following versions or later
Schneider Electric recommends users update their affected devices to the following versions or later:
Mitigation: Only connecting programming software to the network intended for that device.
Only connecting programming software to the network intended for that device.
Mitigation: Properly sanitizing mobile devices that have connected to another network before connecting to the i
Properly sanitizing mobile devices that have connected to another network before connecting to the intended network.
Mitigation: Placing all controllers in locked cabinets, and do not leave them in the "Program" mode.
Placing all controllers in locked cabinets, and do not leave them in the "Program" mode.
Mitigation: PowerChute Network Shutdown
PowerChute Network Shutdown
Mitigation: For more information, refer to the Schneider Electric Recommended Cybersecurity Best Practices docum
For more information, refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
Mitigation: Using secure methods, such as virtual private networks (VPNs), when remote access is required.
Using secure methods, such as virtual private networks (VPNs), when remote access is required.
Patch: Schneider Electric became aware of a public PoC detailing an exploit for prior versions of the APC E
Schneider Electric became aware of a public PoC detailing an exploit for prior versions of the APC Easy UPS Online Monitoring Software, and strongly recommends all users take the defensive actions listed in this advisory.
Mitigation: Users can contact Schneider Electric's Customer Care Center for additional assistance.
Users can contact Schneider Electric's Customer Care Center for additional assistance.
Mitigation: Scanning all methods of mobile data exchange with the isolated network before use in the terminals o
Scanning all methods of mobile data exchange with the isolated network before use in the terminals or nodes connected to these networks.
Mitigation: Installing physical controls to help prevent unauthorized users from accessing industrial control an
Installing physical controls to help prevent unauthorized users from accessing industrial control and safety systems, components, peripheral equipment, and networks.
Mitigation: Locating control and safety system networks and remote devices behind firewalls and isolating them f
Locating control and safety system networks and remote devices behind firewalls and isolating them from the business network.
Mitigation: For more information, see Schneider Electric security notification SEVD-2023-101-04
For more information, see Schneider Electric security notification SEVD-2023-101-04
Mitigation: Schneider Electric recommends that users use appropriate patching methodologies when applying these
Schneider Electric recommends that users use appropriate patching methodologies when applying these patches to their systems and impact evaluate these patches in a test, development, or offline infrastructure environment. Schneider Electric strongly recommends the use of backups.
Mitigation: Minimizing network exposure for all control system devices and systems and ensure that they are not
Minimizing network exposure for all control system devices and systems and ensure that they are not accessible from the internet.
Patch: APC Easy UPS Online Monitoring Software: Version 2.6-GA or later
APC Easy UPS Online Monitoring Software: Version 2.6-GA or later

// References