Skip to content
OpenAdvisories
Medium ICSA-21-313-01 6 CVEs

Schneider Electric NMC cards and Embedded Devices

Published Nov 9, 2021 · Updated Nov 9, 2021

Vendor: Schneider Electric Product: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS Symmetra and Galaxy 3500 with Network Management Card 2 (NMC2) Product: 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS Symmetra and Galaxy 3500 with Network Management Card 3 (NMC3) Product: 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2) Symmetra PX 20/40 kW UPS (SY3P) Gutor (SXW GVX) and Galaxy (GVMTS GVMSA GVXTS GVXSA G7K Product: APC 3-Phase Power Distribution Products using NMC2 Product: APC Rack Power Distribution Units (PDU) using NMC2 Product: APC Rack Power Distribution Units (PDU) using NMC3 Product: Environmental Monitoring Unit with embedded NMC2 (NB250) NetBotz NBRK0250 Product: Network Management Card 2 (NMC2) AP9922 Battery Management System (BM4) Product: Network Management Card 2 (NMC2) Cooling Products Product: Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P) Product: Network Management Card 2 for 400 and 500 kVA (PMM) Product: Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) Product: Network Management Card 2 for Modular 150/175kVA PDU (XRDP) Product: Network Management Card 2 for Modular PDU (XRDP2G) Product: Rack Automatic Transfer Switches (ATS)

Summary

Successful exploitation of these vulnerabilities may allow data disclosure or cross-site scripting, which could result in an execution of malicious web code or a loss of device functionality.

Vulnerabilities 6

  • Unscored —
    CVE-2021-22810

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

  • Unscored —
    CVE-2021-22811

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

  • Unscored —
    CVE-2021-22812

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

  • Unscored —
    CVE-2021-22813

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

  • Unscored —
    CVE-2021-22814

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists whi…

  • Unscored —
    CVE-2021-22815

    A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. Affe…

Revision history

  1. #1

    ICSA-21-313-01 Schneider NMC Cards and Embedded Devices

References