APC Easy UPS Online Monitoring Software - embedded database credentials: Hardcoded credentials let any local user

Impact

Hardcoded credentials let any local user connect to the software's database and escalate. The database holds the site's UPS inventory and the credentials used to command shutdowns, so this converts a low-privilege foothold on one Windows host into control of the power-shutdown path.

Who can reach it

Local access to the machine running the monitoring software.

What to do

Software upgrade. Hardcoded credentials mean the value is public once the advisory ships, so also confirm the database is not listening beyond localhost. Cheap to fix, and worth doing in the same window as the two RCEs above.

References

Related entries

• Linux kernel i2c-mlxbf (BlueField DPU I2C/SMBus controller): memcpy() is called in a loop with no upper boundCVE-2022-48632 · Linux kernel i2c-mlxbf (BlueField DPU I2C/SMBus controller)High
• Linux kernel (drivers/infiniband/core): A heap use-after-free in the userspace RDMA connection-manager interface.CVE-2022-48726 · Linux kernel (drivers/infiniband/core)High
• Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/ipoib): Creating an IPoIB PKEY child interface with fewer RXCVE-2022-48883 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/ipoib)High
• Linux kernel (drivers/infiniband/core): An unprivileged tenant corrupts RDMA connection-manager state and lands aCVE-2022-48925 · Linux kernel (drivers/infiniband/core)High
• Linux kernel mlx5_core eswitch offloads (termination tables): Adding a multi-destination eswitch rule that partiallyCVE-2022-49025 · Linux kernel mlx5_core eswitch offloads (termination tables)High
• Linux kernel (drivers/infiniband/hw/hfi1): The driver drops the last reference on a process's memory-descriptorCVE-2022-49076 · Linux kernel (drivers/infiniband/hw/hfi1)High