CVE-2022-22806 Overview
CVE-2022-22806 is an authentication bypass vulnerability [CWE-294] affecting multiple Schneider Electric SmartConnect UPS product families. The flaw allows a remote attacker to establish an unauthenticated connection to the Uninterruptible Power Supply (UPS) by sending a malformed connection request. Because the affected devices manage power delivery to critical infrastructure, successful exploitation undermines the confidentiality, integrity, and availability of the device and the systems it supports. The vulnerability is exploitable over the network without user interaction or prior privileges.
Critical Impact
A remote, unauthenticated attacker can bypass authentication on Schneider Electric SmartConnect UPS devices and gain control of power management functions, potentially causing service disruption to downstream systems.
Affected Products
- Schneider Electric SmartConnect SMT Series (ID=1015): UPS firmware 04.5 and prior
- Schneider Electric SmartConnect SMC Series (ID=1018): UPS firmware 04.2 and prior; SMTL Series (ID=1026): UPS firmware 02.9 and prior
- Schneider Electric SmartConnect SCL Series (IDs 1029/1030/1036: UPS firmware 02.5 and prior; ID=1037: UPS firmware 03.1 and prior) and SMX Series (ID=1031): UPS firmware 03.1 and prior
Discovery Timeline
- 2022-03-09 - CVE-2022-22806 published to the National Vulnerability Database (NVD)
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2022-22806
Vulnerability Analysis
The vulnerability is classified under [CWE-294] Authentication Bypass by Capture-replay. The affected SmartConnect UPS firmware fails to validate the integrity and freshness of authentication exchanges during connection establishment. An attacker who sends a malformed connection request can bypass the authentication handshake and interact with the device as if authenticated.
Once authenticated bypass is achieved, the attacker can issue management commands to the UPS. These commands include shutting down outputs, modifying configuration, and altering power delivery to attached equipment. In data center and industrial control system (ICS) environments, this can disrupt downstream servers, network gear, or safety systems.
The attack requires only network reachability to the UPS management interface. No credentials, user interaction, or privileged access are needed.
Root Cause
The root cause is improper validation of authentication messages in the SmartConnect protocol implementation. The firmware accepts replayed or malformed authentication frames without verifying cryptographic freshness, such as nonces or session-bound tokens. This allows captured or crafted traffic to satisfy authentication checks that should reject it.
Attack Vector
The attack vector is the network-facing SmartConnect management service on the UPS. An attacker on the same network segment, or with routed access to the UPS management interface, sends a crafted connection message that the firmware mishandles. The firmware responds by treating the connection as authenticated. The vulnerability mechanism is described in the Schneider Electric Security Advisory SEVD-2022-067-02.
No verified proof-of-concept code is publicly available for this CVE. Refer to the vendor advisory for protocol-level technical details.
Detection Methods for CVE-2022-22806
Indicators of Compromise
- Unexpected connections to UPS management ports from hosts that do not normally administer power equipment
- UPS configuration changes, outlet group toggles, or shutdown events that do not correlate with scheduled maintenance or administrator activity
- Repeated malformed or truncated authentication packets directed at SmartConnect management interfaces
- New or unrecognized client sessions appearing in UPS device logs
Detection Strategies
- Monitor network traffic destined for UPS management interfaces and alert on connections from outside the dedicated management VLAN
- Inspect SmartConnect protocol exchanges for malformed handshake messages or repeated session attempts from a single source
- Correlate UPS event logs with change-management records to identify configuration changes lacking an authorized origin
Monitoring Recommendations
- Forward UPS syslog and SNMP trap data to a centralized logging platform for retention and correlation
- Baseline normal administrative source addresses for UPS access and alert on deviations
- Track firmware version inventory across all SmartConnect UPS devices to identify unpatched units
How to Mitigate CVE-2022-22806
Immediate Actions Required
- Identify all Schneider Electric SmartConnect SMT, SMC, SMTL, SCL, and SMX series UPS devices and record their firmware versions
- Isolate UPS management interfaces on a dedicated management VLAN with strict access control lists (ACLs) restricting access to authorized administrative hosts
- Apply the firmware updates referenced in Schneider Electric Security Advisory SEVD-2022-067-02
- Audit UPS configurations and event logs for unauthorized changes since deployment
Patch Information
Schneider Electric has published remediation guidance and updated firmware for the affected SmartConnect UPS product families. Refer to the Schneider Electric Security Advisory SEVD-2022-067-02 for version-specific firmware downloads and installation instructions for each affected series.
Workarounds
- Disable the SmartConnect cloud and remote management features on devices where they are not required
- Place UPS devices behind a firewall and permit management traffic only from a hardened jump host
- Use network segmentation to ensure UPS management interfaces are unreachable from general user, guest, or internet-facing networks
- Monitor UPS device logs continuously and forward events to a SIEM for correlation with broader environment activity
# Example: restrict access to UPS management interface using iptables on a gateway
# Replace UPS_IP and ADMIN_HOST with actual addresses
iptables -A FORWARD -s ADMIN_HOST -d UPS_IP -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s ADMIN_HOST -d UPS_IP -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d UPS_IP -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
