Skip to content
OpenAdvisories
Unscored 1 exploited CVE SEVD-2020-174-01 17 CVEs

APC by Schneider Electric Network Management Cards (NMC) and NMC Embedded Devices

Published Jun 22, 2020 · Updated Jun 30, 2021 · Revision 9

Vendor: Schneider Electric Product: APC 3-Phase Power Distribution Products: 400 and 500 kVA PMM (PMM) Product: APC 3-Phase Power Distribution Products: InfraStruXure 150kVA PDU with 84 poles (X84P) Product: APC 3-Phase Power Distribution Products: InfraStruXure 40 and 60 kVA PDU (XPDU) Product: APC 3-Phase Power Distribution Products: Modular 150 and 175 kVA PDU NAM (XRDP) Product: APC 3-Phase Power Distribution Products: Modular PDU/RPP (XRDP2G) Product: APC Rack Power Distribution Units (rPDU) Embedded NMC1: Metered/Switched Rack PDUs with embedded NMC1 - AP78XX, AP79XX Product: APC Rack Power Distribution Units (rPDU) Embedded NMC2: 2G Metered/Switched Rack PDUs with embedded NMC2 Product: APC Rack Power Distribution Units (rPDU) Embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX Product: Battery Management - Battery Management System - AP9920B1 Product: Battery Management - Battery Management System - AP9921X Product: Battery Management Embedded NMC2 - Battery Manager - AP9922 Product: Cooling Products - InRow Product: Cooling Products - NetworkAir Product: Cooling Products Embedded NMC1 - Rack Air Removal Unit SX (RARU) Product: Cooling Products Embedded NMC2 & Touchscreen Displays: InRow Product: Cooling Products Embedded NMC2 & Touchscreen Displays: Uniflair Cooling Devices Product: Environmental Monitoring AP9319 AP9320 AP9340 AP9360 AP9361 NetBotz NBRK0200 Product: Environmental Monitoring Environmental Monitoring Unit with embedded NMC2 - NetBotz NBRK0250 Product: NMC1 AOS Product: NMC1 Products Symmetra UPS Network Management Card 1 (NMC1) SmartSlot Models: - AP9617 (discontinued in Nov 2011) Product: NMC2 AOS Product: NMC3 AOS Product: Rack Automatic Transfer Switches (ATS) Embedded NMC1: - Rack Automatic Transfer Switches - AP77XX Product: Rack Automatic Transfer Switches (ATS) Embedded NMC2: - Rack Automatic Transfer Switches - AP44XX Product: Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9617 (discontinued in Nov 2011) Product: Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9618 (discontinued in Jan 2017) Product: Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9619 (discontinued in Sep 2012) Product: Uninterruptable Power Supply (UPS) using NMC1 - SUMX Smart-UPS models embedded with NMC1 Product: Uninterruptible Power Supply (UPS) using NMC2 1-Phase and 3-Phase UPS models including Smart-UPS, Symmetra, and Galaxy with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J +1 more

Summary

Schneider Electric became aware of multiple vulnerabilities affecting Treck Inc.'s embedded TCP/IP
stack, collectively known as Ripple20, which Treck publicly disclosed on June 16, 2020. Schneider
Electric is also aware of a proof of concept published by JSOF that demonstrates how one of the
Treck vulnerabilities, CVE-2020-11901, can be exploited to affect a Schneider Electric APC SmartUPS device using certain Network Management Card firmware versions.
On October 12, 2020, Schneider Electric received additional information and analysis from JSOF
related to CVE-2020-11901’s impact on APC by Schneider Electric Network Management Cards and
NMC embedded devices. This new analysis indicates that the information we originally received was
incomplete. Therefore our original remediations are only partially effective for CVE-2020-11901. We
are expediting updated remediations, which will be made available as soon as possible. In the
meantime, customers should immediately apply the mitigations included in Remediation & Mitigations
section of this document.
June 2021 Update: Added remediations for Uninterruptible Power Supply (UPS), Rack Power
Distribution Units (rPDU), Battery Management, Rack Automatic Transfer Switch (ATS), Rack Air
Removal Unit (RARU) using NMC1, as well as all other remaining NMC1 applications.

Vulnerabilities 17

  • Medium 5.4
    CVE-2020-11899 Exploited EPSS 18%

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2020-11910 EPSS 11%

    The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.

  • Critical 9.1
    CVE-2020-11909

    The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.

  • Unscored —
    CVE-2020-11896 Public exploit EPSS 37%

    The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

  • Unscored —
    CVE-2020-11898 Public exploit EPSS 19%

    The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might al…

  • Unscored —
    CVE-2020-11901 EPSS 22%

    The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.

  • Unscored —
    CVE-2020-11902

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.

  • Unscored —
    CVE-2020-11903

    The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.

  • Unscored —
    CVE-2020-11904

    The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Wr…

  • Unscored —
    CVE-2020-11905

    The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.

  • Unscored —
    CVE-2020-11906

    The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.

  • Unscored —
    CVE-2020-11907

    The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.

  • Unscored —
    CVE-2020-11908

    The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.

  • Unscored —
    CVE-2020-11911

    The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.

  • Unscored —
    CVE-2020-11912

    The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.

  • Unscored —
    CVE-2020-11913

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

  • Unscored —
    CVE-2020-11914

    The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.

Revision history

  1. #2.3.0

    Added remediations for Uninterruptible Power Supply (UPS), Rack Power Distribution Units (rPDU), Battery Management, Rack Automatic Transfer Switch (ATS), Rack Air Removal Unit (RARU) using NMC1, as well as all other remaining NMC1 applications (page 2, 4-6)

  2. #2.2.0

    Added remediations for Uninterruptible Power Supply (UPS) using NMC3 (page 2)

  3. #2.1.0

    Added remediations for Uninterruptible Power Supply (UPS) using NMC2, APC 3-Phase Power Distribution Products using NMC2, APC Rack Power Distribution Units (PDU) using NMC2, Rack Automatic Transfer Switches (ATS) using NMC2, Environmental Monitoring using NMC2, Cooling Products using NMC2 (page 2-4)

  4. #2.0.0

    Updated overview section, available remediations and affected products tables. New information regarding CVE-2020-11901. Added remediations for “APC 3-Phase Power Distribution Products”, “APC Rack Power Distribution Units (PDU)”, :Rack Automatic Transfer Switches (ATS)”, “Environmental Monitoring” (page 1-6)

  5. #1.4.0

    Added remediation for Cooling Products using NMC2 (page 2)

  6. #1.3.0

    Corrected affected version(s) and enhanced Remediation/Mitigation version details for “Uninterruptible Power Supply (UPS) using NMC2” (page 2)

  7. #1.2.0

    Updated remediation for “Uninterruptible Power Supply (UPS) using NMC2” (page 2)

  8. #1.1.0

    Updated Affected Products & Details and Vulnerability Details sections formatting for clarity (pages 2-5)

  9. #1.0.0

    Original Release

References