CVE-2022-42972 – This vulnerability allows local attackers to es... (How to Fix)

Q: What is the severity of CVE-2022-42972?

CVE-2022-42972 has a CVSS score of 7.8 (HIGH). This vulnerability allows local attackers to escalate privileges by modifying the webroot directory due to incorrect permissions. It affects APC and Schneider Electric Easy UPS Online Monitoring Software on Windows systems. Attackers must have local access to exploit this flaw.

📋 TL;DR

This vulnerability allows local attackers to escalate privileges by modifying the webroot directory due to incorrect permissions. It affects APC and Schneider Electric Easy UPS Online Monitoring Software on Windows systems. Attackers must have local access to exploit this flaw.

💻 Affected Systems

Products:

APC Easy UPS Online Monitoring Software
Schneider Electric Easy UPS Online Monitoring Software

Versions: Versions prior to V2.5-GA, V2.5-GA-01-22261, V2.5-GS, V2.5-GS-01-22261

Operating Systems: Windows 7, Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022

Default Config Vulnerable: ⚠️ Yes

Notes: Both APC and Schneider Electric branded versions are affected. The vulnerability exists in the default installation configuration.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attacker gains SYSTEM/administrator privileges, enabling complete system compromise, data theft, malware installation, or persistence mechanisms.

🟠

Likely Case

Local user with standard privileges escalates to administrative rights, allowing unauthorized software installation, configuration changes, or access to sensitive system resources.

🟢

If Mitigated

With proper access controls and least privilege principles, impact is limited to the specific application's context rather than full system compromise.

🌐 Internet-Facing: LOW - This is a local privilege escalation requiring local access; not directly exploitable over the network.

🏢 Internal Only: HIGH - Any local user (including low-privilege accounts) could potentially exploit this to gain administrative privileges on affected systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access but appears straightforward based on the CWE-732 description. No public exploit code has been identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: V2.5-GA, V2.5-GA-01-22261, V2.5-GS, V2.5-GS-01-22261 or later

Vendor Advisory: https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf

Restart Required: Yes

Instructions:

1. Download the updated software version from Schneider Electric/APC website. 2. Uninstall the vulnerable version. 3. Install the patched version. 4. Restart the system.

🔧 Temporary Workarounds

Restrict webroot directory permissions

windows

Manually adjust permissions on the Easy UPS webroot directory to prevent unauthorized modifications

icacls "C:\Program Files\APC\Easy UPS Online Monitoring\webroot" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" /deny "Users:(OI)(CI)(W)"

🧯 If You Can't Patch

Implement strict access controls to limit local user access to systems running the vulnerable software
Monitor for unauthorized privilege escalation attempts and file permission changes in the webroot directory

🔍 How to Verify

Check if Vulnerable:

Check installed version via Control Panel > Programs and Features or by running the software and checking the About section

Check Version:

wmic product where "name like '%Easy UPS Online Monitoring%'" get version

Verify Fix Applied:

Verify version is V2.5-GA, V2.5-GA-01-22261, V2.5-GS, V2.5-GS-01-22261 or later, and check webroot directory permissions are properly restricted

📡 Detection & Monitoring

Log Indicators:

Unexpected permission changes to webroot directory
Privilege escalation events in Windows Security logs
Unauthorized access attempts to Easy UPS directories

Network Indicators:

Not applicable - local exploitation only

SIEM Query:

EventID=4672 OR EventID=4688 AND ProcessName LIKE '%Easy UPS%' OR FilePath LIKE '%webroot%' AND AccessMask='WRITE_DAC' OR 'WRITE_OWNER'

📊 Metadata

CVE ID: CVE-2022-42972

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-732

Published: February 1, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-42972, you might also want to check these: