1. Home
  2. CVE Database
  3. CVE-2022-22805
CRITICAL · 9.8

CVE-2022-22805

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affe...

Vulnerability Description

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Schneider-ElectricSmt Series 1015 Ups Firmware<= 04.5
Schneider-ElectricSmt Series 1015 Ups-
Schneider-ElectricSmc Series 1018 Ups Firmware<= 04.2
Schneider-ElectricSmc Series 1018 Ups-
Schneider-ElectricSmtl Series 1026 Ups Firmware<= 02.9
Schneider-ElectricSmtl Series 1026 Ups-
Schneider-ElectricScl Series 1029 Ups Firmware<= 02.5
Schneider-ElectricScl Series 1029 Ups-
Schneider-ElectricScl Series 1030 Ups Firmware<= 02.5
Schneider-ElectricScl Series 1030 Ups-
Schneider-ElectricScl Series 1036 Ups Firmware<= 02.5
Schneider-ElectricScl Series 1036 Ups-
Schneider-ElectricScl Series 1037 Ups Firmware<= 03.1
Schneider-ElectricScl Series 1037 Ups-
Schneider-ElectricSmx Series 1031 Ups Firmware<= 03.1
Schneider-ElectricSmx Series 1031 Ups-

Related Weaknesses (CWE)

CWE-120

References

FAQ

What is CVE-2022-22805?

CVE-2022-22805 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affe...

How severe is CVE-2022-22805?

CVE-2022-22805 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-22805?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Smt Series 1015 Ups Firmware, Schneider-Electric Smt Series 1015 Ups, Schneider-Electric Smc Series 1018 Ups Firmware, Schneider-Electric Smc Series 1018 Ups, Schneider-Electric Smtl Series 1026 Ups Firmware.