Skip to content
OpenAdvisories
Medium SEVD-2021-313-03 6 CVEs

APC by Schneider Electric Network Management Cards (NMC) and NMC Embedded Devices

Published Nov 9, 2021 · Updated May 10, 2022 · Revision 2

Vendor: Schneider Electric Product: 2G Metered/Switched Rack PDUs with embedded NMC2 Product: 2G Metered/Switched Rack PDUs with embedded NMC3 Product: AP9922 Battery Management System (BM4) Product: Ecoflair IAEC25/50 Air Economizer Display (EB2G) Product: EcoStruxure Micro Data Center (MDC) Product: Galaxy 3500 Product: Galaxy 3500 (G300, GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU, CHU) Product: Galaxy RPP Product: GRPPIP2X84 Product: Gutor (SXW, GVX) Product: InRow Cooling Display for series ACRD3xx (ACRC2G) Product: InRow Cooling for series ACRC10x SKUs (RC10X2G) Product: InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G) Product: InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G) Product: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G) Product: InRow Cooling for series ACSC1xx SKUs (SC2G) Product: NetBotz NBRK0250 Product: PD40E5EK20-M Product: PD40F6FK1-M Product: PD40G6FK1-M Product: PD40H5EK20-M Product: PD40L6FK1-M Product: PD60F6FK1 Product: PD60G6FK1 Product: PD60L6FK1 Product: PDPB150G6F Product: PDPM138H-5U Product: PDPM138H-R Product: PDPM144F +33 more

Summary

Schneider Electric is aware of multiple vulnerabilities in its products that use the Network Management Card 2 (NMC2), Network Management Card 3 (NMC3), and the NMC embedded devices.
The NMC2 and the NMC3 cards and embedded devices allow for secure monitoring and control of APC by Schneider Electric products.
Failure to apply the mitigations provided below may risk potential data disclosure or cross-site scripting which could result in execution of malicious web code or loss of device functionality.

Vulnerabilities 6

  • Unscored —
    CVE-2021-22810

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

  • Unscored —
    CVE-2021-22811

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

  • Unscored —
    CVE-2021-22812

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

  • Unscored —
    CVE-2021-22813

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…

  • Unscored —
    CVE-2021-22814

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists whi…

  • Unscored —
    CVE-2021-22815

    A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. Affe…

Revision history

  1. #2

    Remediations added for remaining affected products: APC Power Distribution products, Cooling products, Environmental Monitoring products, and Battery Management products.

  2. #1

    Original Release

References