{"id":"CVE-2023-29413","state":"PUBLISHED","title":"CVE-2023-29413","description":"\nA CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause\nDenial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor\nservice. \n\n \n\n\n\n","publishedAt":"2023-04-18T20:50:53.336Z","updatedAt":"2025-02-05T20:59:20.742Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"schneider"},"assigner":"schneider","products":["Schneider Electric APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","Schneider Electric Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)"],"affected":[{"vendor":"Schneider Electric","product":"APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","defaultStatus":"unaffected","versions":[{"version":"V2.5-GA-01-22320","status":"affected","lessThanOrEqual":"prior","versionType":"custom"}]},{"vendor":"Schneider Electric","product":"Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","defaultStatus":"unaffected","versions":[{"version":"V2.5-GS-01-22320","status":"affected","lessThanOrEqual":"prior","versionType":"custom"}]}],"references":["https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/29xxx/CVE-2023-29413.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-29413","state":"PUBLISHED","datePublished":"2023-04-18T20:50:53.336Z","dateUpdated":"2025-02-05T20:59:20.742Z","assignerShortName":"schneider","assignerOrgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateReserved":"2023-04-05T20:35:41.367Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"\nA CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause\nDenial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor\nservice. \n\n \n\n\n\n"}],"affected":[{"vendor":"Schneider Electric","product":"APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","defaultStatus":"unaffected","versions":[{"version":"V2.5-GA-01-22320","status":"affected","lessThanOrEqual":"prior","versionType":"custom"}]},{"vendor":"Schneider Electric","product":"Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)","defaultStatus":"unaffected","versions":[{"version":"V2.5-GS-01-22320","status":"affected","lessThanOrEqual":"prior","versionType":"custom"}]}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"schneider","orgId":"076d1eb6-cfab-4401-b34d-6dfc2a413bdb","dateUpdated":"2023-04-18T20:50:53.336Z"},"datePublic":"2023-04-11T07:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T14:07:45.947Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-05T20:59:10.323751Z","id":"CVE-2023-29413","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-05T20:59:20.742Z"}}]}}}