Vulnerability · Published Mar 9, 2022 · Assigned by schneider

CVE-2022-22805

Critical 9.8

In plain English

A critical-severity buffer overflow in SmartConnect from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.9% (higher than 96% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)11.9%top 3.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

Affected products (as reported)

Vendor	Product	Versions
Schneider Electric	SmartConnect	SMT SeriesSMC SeriesSMTL SeriesSCL SeriesSMX Series

Weakness: CWE-120

References

https://www.se.com/ww/en/download/document/SEVD-2022-067-02/ x_refsource_MISC