What’s Vulnerable › Vulnerabilities

CVE-2023-29411

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-18 · updated 2026-06-17
• Weakness: CWE-306

Description

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interface.

Affected products

• Schneider Electric APC Easy UPS Online Monitoring Software: through 2.5-ga-01-22320
• Schneider Electric Easy UPS Online Monitoring Software: through 2.5-gs-01-22320

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-04.pdf

Get alerted when CVE-2023-29411 or the next vulnerability affects your stack