Log in Start free

Vulnerability · Published Mar 9, 2022 · Assigned by schneider

CVE-2022-22806

Critical 9.8

In plain English

A critical-severity security flaw in SmartConnect from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.5% (higher than 96% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)12.5%top 3.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

Affected products (as reported)

VendorProductVersions
Schneider Electric SmartConnect SMT SeriesSMC SeriesSMTL SeriesSCL SeriesSMX Series

Weakness: CWE-294

References