Read the docs
TI-2022-20952 Aliases CVE-2022-42972GHSA-gcjp-7fh4-w3cp

Incorrect permission assignment in Schneider Electric APC Easy UPS Online Monitoring…

Priority LOW 35CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00179 7th percentileScored 2026-11-07
Fix Fixed APC Easy UPS Online Monitoring Software (Schneider Electric): V2.5-GA, V2.5-GA-01-22261Schneider Electric Easy UPS Online Monitoring Software (Schneider Electric): V2.5-GS, V2.5-GS-01-22261

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schneider ElectricAPC Easy UPS Online Monitoring SoftwareWindows 7, 10, 11 Windows Server 2016, 2019, 2022 to before V2.5-GAV2.5-GAPatch availableCNA
Schneider ElectricAPC Easy UPS Online Monitoring Software(Windows 11, Windows Server 2019, 2022 to before V2.5-GA-01-22261V2.5-GA-01-22261Patch availableCNA
Schneider ElectricSchneider Electric Easy UPS Online Monitoring SoftwareWindows 7, 10, 11 Windows Server 2016, 2019, 2022 to before V2.5-GSV2.5-GSPatch availableCNA
Schneider ElectricSchneider Electric Easy UPS Online Monitoring SoftwareWindows 11, Windows Server 2019, 2022 to before V2.5-GS-01-22261V2.5-GS-01-22261Patch availableCNA
  • APC Easy UPS Online Monitoring Software VendorSchneider Electric Affected Windows 7, 10, 11 Windows Server 2016, 2019, 2022 to before V2.5-GA Fixed in V2.5-GA Patch available CNA
  • APC Easy UPS Online Monitoring Software VendorSchneider Electric Affected (Windows 11, Windows Server 2019, 2022 to before V2.5-GA-01-22261 Fixed in V2.5-GA-01-22261 Patch available CNA
  • Schneider Electric Easy UPS Online Monitoring Software VendorSchneider Electric Affected Windows 7, 10, 11 Windows Server 2016, 2019, 2022 to before V2.5-GS Fixed in V2.5-GS Patch available CNA
  • Schneider Electric Easy UPS Online Monitoring Software VendorSchneider Electric Affected Windows 11, Windows Server 2019, 2022 to before V2.5-GS-01-22261 Fixed in V2.5-GS-01-22261 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:schneider-electric:apc_easy_ups_online_monitoring_software:*:*:*:*:*:*:*:*before 2.5-ga-01-22320VulnerableSchneider Electric
cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:-:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:schneider-electric:easy_ups_online_monitoring_software:*:*:*:*:*:*:*:*before 2.5-gs-01-22320VulnerableSchneider Electric
cpe:2.3:a:schneider-electric:apc_easy_ups_online_monitoring_software:*:*:*:*:*:*:*:*before 2.5-gaVulnerableSchneider Electric
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:-:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:schneider-electric:easy_ups_online_monitoring_software:*:*:*:*:*:*:*:*before 2.5-gsVulnerableSchneider Electric
  • cpe:2.3:a:schneider-electric:apc_easy_ups_online_monitoring_software:*:*:*:*:*:*:*:* Versions before 2.5-ga-01-22320 Vulnerable ·Schneider Electric
  • cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:-:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:schneider-electric:easy_ups_online_monitoring_software:*:*:*:*:*:*:*:* Versions before 2.5-gs-01-22320 Vulnerable ·Schneider Electric
  • cpe:2.3:a:schneider-electric:apc_easy_ups_online_monitoring_software:*:*:*:*:*:*:*:* Versions before 2.5-ga Vulnerable ·Schneider Electric
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:-:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:schneider-electric:easy_ups_online_monitoring_software:*:*:*:*:*:*:*:* Versions before 2.5-gs Vulnerable ·Schneider Electric

Remediation

  • Fix · CNA APC Easy UPS Online Monitoring Software (Schneider Electric) Fixed in V2.5-GA
  • Fix · CNA APC Easy UPS Online Monitoring Software (Schneider Electric) Fixed in V2.5-GA-01-22261
  • Fix · CNA Schneider Electric Easy UPS Online Monitoring Software (Schneider Electric) Fixed in V2.5-GS
  • Fix · CNA Schneider Electric Easy UPS Online Monitoring Software (Schneider Electric) Fixed in V2.5-GS-01-22261

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Schneider Electric APC Easy UPS Online Monitoring Software, Schneider Electric Easy UPS Online Monitoring Software V2.5-GA, V2.5-GA-01-22261 and 2 more versions

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-20951 Unrestricted file upload in Schneider Electric APC Easy UPS Online Monitoring SoftwarePriority MEDIUM 51
    • TI-2022-20950 Missing authentication in Schneider Electric APC Easy UPS Online Monitoring SoftwarePriority MEDIUM 50
    • TI-2022-20953 Hard-coded credentials in Schneider Electric APC Easy UPS Online Monitoring SoftwarePriority LOW 35
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-42972
  2. 2026-10-03 Alias added: GHSA-gcjp-7fh4-w3cp

References

Patch 1

  • TI-2023-13791 Missing authentication in Schneider Electric APC Easy UPS Online Monitoring Software CVSS 3.1CRITICAL 9.8
  • TI-2023-13792 OS command injection in Schneider Electric APC Easy UPS Online Monitoring Software CVSS 3.1CRITICAL 9.8
  • TI-2022-20951 Unrestricted file upload in Schneider Electric APC Easy UPS Online Monitoring Software CVSS 3.1CRITICAL 9.8
  • TI-2022-20950 Missing authentication in Schneider Electric APC Easy UPS Online Monitoring Software CVSS 3.1CRITICAL 9.8
  • TI-2023-13793 Missing authentication in Schneider Electric APC Easy UPS Online Monitoring Software CVSS 3.1HIGH 7.5
  • TI-2022-20953 Hard-coded credentials in Schneider Electric APC Easy UPS Online Monitoring Software CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences