Auth bypass in Microsoft Windows_10
CVE-2023-29411
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interfa…
Vulnerability class: Broken Authentication
EPSS: 0.013 (67.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Windows_10
- Microsoft Windows_11
- Microsoft Windows_server_2016
- Microsoft Windows_server_2019
- Microsoft Windows_server_2022
- Schneider Electric Apc Easy Ups Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) — versions V2.5-GA-01-22320
- Schneider Electric Easy Ups Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) — versions V2.5-GS-01-22320
- Schneider-electric Apc_easy_ups_online_monitoring_software
- Schneider-electric Easy_ups_online_monitoring_software
Weakness classification (CWE)
References
- cybersecurity@se.com (Patch, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-29411?
- CVE-2023-29411 is a critical-severity vulnerability in Microsoft Windows_10, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2023-04-18.
- How severe is CVE-2023-29411?
- Critical severity. CVSS v3 base score is 9.8 out of 10.