{"id":"CVE-2023-29411","state":"PUBLISHED","title":"CVE-2023-29411","description":"\nA CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow\nchanges to administrative credentials, leading to potential remote code execution without\nrequiring prior authentication on the Java RMI interface. \n\n\n\n","publishedAt":"2023-04-18T20:49:34.059Z","updatedAt":"2025-02-05T21:22:08.895Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"schneider"},"assigner":"schneider","products":["Schneider Electric APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","Schneider Electric Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)"],"affected":[{"vendor":"Schneider Electric","product":"APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","defaultStatus":"unaffected","versions":[{"version":"V2.5-GA-01-22320","status":"affected","lessThanOrEqual":"prior","versionType":"custom"}]},{"vendor":"Schneider Electric","product":"Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","defaultStatus":"unaffected","versions":[{"version":"V2.5-GS-01-22320","status":"affected","lessThanOrEqual":"prior","versionType":"custom"}]}],"references":["https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/29xxx/CVE-2023-29411.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-29411","state":"PUBLISHED","datePublished":"2023-04-18T20:49:34.059Z","dateUpdated":"2025-02-05T21:22:08.895Z","assignerShortName":"schneider","assignerOrgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateReserved":"2023-04-05T20:35:41.367Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"\nA CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow\nchanges to administrative credentials, leading to potential remote code execution without\nrequiring prior authentication on the Java RMI interface. \n\n\n\n"}],"affected":[{"vendor":"Schneider Electric","product":"APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","defaultStatus":"unaffected","versions":[{"version":"V2.5-GA-01-22320","status":"affected","lessThanOrEqual":"prior","versionType":"custom"}]},{"vendor":"Schneider Electric","product":"Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","defaultStatus":"unaffected","versions":[{"version":"V2.5-GS-01-22320","status":"affected","lessThanOrEqual":"prior","versionType":"custom"}]}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"schneider","orgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateUpdated":"2023-04-18T20:49:34.059Z"},"datePublic":"2023-04-11T07:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T14:07:46.023Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-05T21:21:55.206695Z","id":"CVE-2023-29411","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-05T21:22:08.895Z"}}]}}}