CVE-2022-42971

State: Published
Severity: 9.8 Critical
Published: Feb 1, 2023
Updated: Feb 5, 2025
Reserved: Oct 17, 2022

Description

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	schneider

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
APC Easy UPS Online Monitoring SoftwareSchneider Electric	Windows 7, 10, 11 Windows Server 2016, 2019, 2022 to before V2.5-GAAffected
APC Easy UPS Online Monitoring SoftwareSchneider Electric	(Windows 11, Windows Server 2019, 2022 to before V2.5-GA-01-22261Affected
Schneider Electric Easy UPS Online Monitoring SoftwareSchneider Electric	Windows 7, 10, 11 Windows Server 2016, 2019, 2022 to before V2.5-GSAffected
Schneider Electric Easy UPS Online Monitoring SoftwareSchneider Electric	Windows 11, Windows Server 2019, 2022 to before V2.5-GS-01-22261Affected

References

https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.