What’s Vulnerable › Vulnerabilities

CVE-2022-22806

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-09 · updated 2026-06-17
• Weakness: CWE-294

Description

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

Affected products

• Schneider-Electric Scl Series 1029 Ups Firmware: through 02.5
• Schneider-Electric Scl Series 1030 Ups Firmware: through 02.5
• Schneider-Electric Scl Series 1036 Ups Firmware: through 02.5
• Schneider-Electric Scl Series 1037 Ups Firmware: through 03.1
• Schneider-Electric Smc Series 1018 Ups Firmware: through 04.2
• Schneider-Electric Smt Series 1015 Ups Firmware: through 04.5
• Schneider-Electric Smtl Series 1026 Ups Firmware: through 02.9
• Schneider-Electric Smx Series 1031 Ups Firmware: through 03.1

References

• https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
• https://www.se.com/ww/en/download/document/SEVD-2022-067-02/

Get alerted when CVE-2022-22806 or the next vulnerability affects your stack