CVE-2022-0715

mediumPriorität · verfolgen · 38OT-Risiko · erhöhtEPSS 0.060 · 93. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

5.96% (93rd) EPSS

CVSS 6.4 · medium

Is it mine?

63 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

EPSS · bewertet 2026-10-27

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.4–9.1

v2.06.4mediumAV:N/AC:L/Au:N/C:N/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 4.9

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.2

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.9highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Hsecondary · ENISA EU

v3.18.9highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:HsecondaryAusnutzbarkeit 2.2 · Auswirkung 6

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-345USprimärCWE-287USCWE-287US

betroffene Produkte (63)

Betroffene Produkte und Versionsbereiche.

Schneider Electric APC Smart-UPS≤ SMC Seriesenisa_euvdEU
Schneider Electric APC Smart-UPS≤ SMX Seriesenisa_euvdEU
Schneider Electric APC Smart-UPS≤ SCL Seriesenisa_euvdEU
Schneider Electric APC Smart-UPS≤ SRT Seriesenisa_euvdEU
Schneider Electric APC Smart-UPS≤ SMT Seriesenisa_euvdEU
Schneider Electric SmartConnect≤ SMC Seriesenisa_euvdEU
Schneider Electric SmartConnect≤ SCL Seriesenisa_euvdEU
Schneider Electric SmartConnect≤ SMTL Seriesenisa_euvdEU
Schneider Electric SmartConnect≤ SMX Seriesenisa_euvdEU
Schneider Electric SmartConnect≤ SMT Seriesenisa_euvdEU
Schneider Electric SCL Series ID=1030≤ 02.5fstec_bduRU
Schneider Electric SCL Series ID=1036≤ 02.5fstec_bduRU
Schneider Electric SMC Series ID=1005≤ 14.1fstec_bduRU
Schneider Electric SMC Series ID=1007≤ 11.0fstec_bduRU
Schneider Electric SMC Series ID=1041≤ 01.1fstec_bduRU
Schneider Electric SMT Series ID=1031≤ 03.1fstec_bduRU
Schneider Electric SMT Series ID=1040≤ 01.2fstec_bduRU
Schneider Electric SMT Series ID=18≤ 09.8fstec_bduRU
Schneider Electric SMX Series ID=20≤ 10.2fstec_bduRU
Schneider Electric SMX Series ID=23≤ 07.0fstec_bduRU

20 von 63 angezeigt

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

veröffentlicht 2022-03-09geändert 2026-06-17

verwandt (1,449)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-38831US	high7.8OT kritisch	99.8% (100th)	KEV	2023-08-23
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may inc…
CVE-2022-40139US	high7.2OT kritisch	3.44% (89th)	KEV	2022-09-19
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administra…
CVE-2022-26871US	critical9.8OT kritisch	19.5% (97th)	KEV	2022-03-29
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execut…
CVE-2019-5591US	medium6.5OT kritisch	18.6% (97th)	KEV	2020-08-14
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
CVE-2023-48795US	medium5.9OT hoch	93.5% (100th)	Exploit	2023-12-18
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet…

+1444 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan