CVE-2022-22806 Auth bypass in SmartConnect

What is CVE-2022-22806?

CVE-2022-22806 is a critical authentication bypass vulnerability in Schneider Electric SmartConnect, published on 9 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

Weakness: CWE-294

Which versions are affected by CVE-2022-22806?

It affects 8 products.

Products include Schneider-Electric Scl Series 1029 Ups Firmware, Schneider-Electric Scl Series 1030 Ups Firmware, Schneider-Electric Scl Series 1036 Ups Firmware, Schneider-Electric Scl Series 1037 Ups Firmware, Schneider-Electric Smc Series 1018 Ups Firmware, Schneider-Electric Smt Series 1015 Ups Firmware and 2 more.

How do I fix CVE-2022-22806?

No fix has been published for CVE-2022-22806 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-22806 being exploited?

There is no known exploitation of CVE-2022-22806 in the wild and no public exploit code.

Other vulnerabilities in Schneider Electric SmartConnect

• CVE-2022-22805 Memory corruption in SmartConnect Critical 9.8
• CVE-2022-0715 Auth bypass in APC Smart-UPS High 8.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hjcg-4h7x-vmj6.