RCE in Microsoft Windows_10
CVE-2023-29412
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when manipulating internal methods through Java RMI interface.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.012 (65.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Windows_10
- Microsoft Windows_11
- Microsoft Windows_server_2016
- Microsoft Windows_server_2019
- Microsoft Windows_server_2022
- Schneider Electric Apc Easy Ups Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) — versions V2.5-GA-01-22320
- Schneider Electric Easy Ups Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022) — versions V2.5-GS-01-22320
- Schneider-electric Apc_easy_ups_online_monitoring_software
- Schneider-electric Easy_ups_online_monitoring_software
Weakness classification (CWE)
References
- cybersecurity@se.com (Patch, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-29412?
- CVE-2023-29412 is a critical-severity vulnerability in Microsoft Windows_10, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-04-18.
- How severe is CVE-2023-29412?
- Critical severity. CVSS v3 base score is 9.8 out of 10.