CVE-2022-22805 Memory corruption in SmartConnect
Remote attackers can execute arbitrary code via a buffer overflow in TLS packet reassembly on Schneider SmartConnect devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22805?
CVE-2022-22805 is a critical memory corruption vulnerability in Schneider Electric SmartConnect, published on 9 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
Weakness: CWE-120
Which versions are affected by CVE-2022-22805?
It affects 8 products.
Products include Schneider-Electric Scl Series 1029 Ups Firmware, Schneider-Electric Scl Series 1030 Ups Firmware, Schneider-Electric Scl Series 1036 Ups Firmware, Schneider-Electric Scl Series 1037 Ups Firmware, Schneider-Electric Smc Series 1018 Ups Firmware, Schneider-Electric Smt Series 1015 Ups Firmware and 2 more.
How do I fix CVE-2022-22805?
No fix has been published for CVE-2022-22805 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-22805 being exploited?
There is no known exploitation of CVE-2022-22805 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric SmartConnect
Sources
Also known as GHSA-w827-q88j-8c47.