Authentication Bypass in SmartConnect Family UPS by Schneider Electric

CVE-2022-22806

Summary

A vulnerability exists in Schneider Electric's SmartConnect Family UPS systems, characterized as an authentication bypass due to capture-replay methods. This vulnerability permits unauthorized users to establish connections by exploiting malformed requests, compromising the integrity and security of the UPS systems. Several UPS models across different series, including SMT, SMC, SMTL, SCL, and SMX, are affected, with specific version details highlighting those that may be susceptible to this exploit. Immediate remediation steps should be taken to prevent potential unauthorized access.

References