CVE-2022-22805 – This CVE describes a critical buffer overflow v... (How to Fix)

Q: What is the severity of CVE-2022-22805?

CVE-2022-22805 has a CVSS score of 9.8 (CRITICAL). This CVE describes a critical buffer overflow vulnerability in Schneider Electric SmartConnect UPS devices that allows remote code execution when processing malformed TLS packets. Attackers can exploit this to take complete control of affected UPS systems. The vulnerability affects multiple UPS series with firmware versions prior to specific updates.

📋 TL;DR

This CVE describes a critical buffer overflow vulnerability in Schneider Electric SmartConnect UPS devices that allows remote code execution when processing malformed TLS packets. Attackers can exploit this to take complete control of affected UPS systems. The vulnerability affects multiple UPS series with firmware versions prior to specific updates.

💻 Affected Systems

Products:

SMT Series UPS
SMC Series UPS
SMTL Series UPS
SCL Series UPS
SMX Series UPS

Versions: SMT Series: UPS 04.5 and prior, SMC Series: UPS 04.2 and prior, SMTL Series: UPS 02.9 and prior, SCL Series: UPS 02.5/03.1 and prior (depending on ID), SMX Series: UPS 03.1 and prior

Operating Systems: Embedded firmware on UPS devices

Default Config Vulnerable: ⚠️ Yes

Notes: Affects specific Series IDs: SMT (1015), SMC (1018), SMTL (1026), SCL (1029, 1030, 1036, 1037), SMX (1031)

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote unauthenticated attacker gains full system control, executes arbitrary code, disrupts power management, and pivots to other network systems.

🟠

Likely Case

Remote code execution leading to UPS device compromise, potential power disruption, and network foothold for further attacks.

🟢

If Mitigated

If properly segmented and patched, impact limited to UPS device itself with no network propagation.

🌐 Internet-Facing: HIGH - Directly exploitable over network via TLS packets, CVSS 9.8 indicates critical remote attack vector.

🏢 Internal Only: HIGH - Even internally, vulnerable devices can be exploited by attackers who gain network access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Buffer overflow via TLS packet reassembly requires crafting specific malformed packets but no authentication needed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: See vendor advisory for specific firmware updates per product series

Vendor Advisory: https://www.se.com/ww/en/download/document/SEVD-2022-067-02/

Restart Required: Yes

Instructions:

1. Identify UPS model and Series ID. 2. Download appropriate firmware update from Schneider Electric portal. 3. Apply firmware update following vendor instructions. 4. Reboot UPS device.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate UPS devices on separate VLAN with strict firewall rules limiting access to management interfaces.

TLS Inspection Blocking

all

Configure network devices to inspect and block malformed TLS packets targeting UPS management ports.

🧯 If You Can't Patch

Segment UPS devices on isolated network with no internet access
Implement strict firewall rules allowing only necessary management traffic from trusted sources

🔍 How to Verify

Check if Vulnerable:

Check UPS firmware version via management interface or Schneider Electric management software against affected versions list.

Check Version:

Use Schneider Electric management software or web interface to check firmware version

Verify Fix Applied:

Confirm firmware version has been updated to patched version via management interface.

📡 Detection & Monitoring

Log Indicators:

Multiple failed TLS handshake attempts
Unexpected device reboots
Unusual network traffic to UPS management ports

Network Indicators:

Malformed TLS packets to UPS management ports (typically 443/TLS)
Unexpected outbound connections from UPS devices

SIEM Query:

source_ip="UPS_IP" AND (port=443 OR port=8443) AND (tls.handshake.failed OR packet.size>threshold)

📊 Metadata

CVE ID: CVE-2022-22805

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-120

Published: March 9, 2022

Last Updated: November 21, 2024

🔗 References

https://www.se.com/ww/en/download/document/SEVD-2022-067-02/ Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2022-067-02/ Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-22805, you might also want to check these: