CVE-2022-42971

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker…

Critical9.8EPSS 1.1%

Published: 1 Feb 2023
Updated: 5 Feb 2025
Reserved: 17 Oct 2022
Assigned by: schneider

Description

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)

Scores

CVSS scores of CVE-2022-42971, by who scored it
Scored by	CVSS	Score	Vector
schneiderCNA (assigner)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 1.1% · top 35% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type (opens in a new tab)All about CWE-434 and its CVEs

Affected products

Schneider Electric · APC Easy UPS Online Monitoring Software
- affected Windows 7, 10, 11 Windows Server 2016, 2019, 2022 – < V2.5-GA
Schneider Electric · APC Easy UPS Online Monitoring Software
- affected (Windows 11, Windows Server 2019, 2022 – < V2.5-GA-01-22261
Schneider Electric · Schneider Electric Easy UPS Online Monitoring Software
- affected Windows 7, 10, 11 Windows Server 2016, 2019, 2022 – < V2.5-GS
Schneider Electric · Schneider Electric Easy UPS Online Monitoring Software
- affected Windows 11, Windows Server 2019, 2022 – < V2.5-GS-01-22261

References (1)

https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-42971](https://trackcve.app/badge/CVE-2022-42971.svg)](https://trackcve.app/cve/CVE-2022-42971)

Record last updated 5 Feb 2025, 20:16 UTC.