Versio.io

CVE-2021-22813

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 28-01-2022 09:15
Last modified: - 04-02-2022 05:41
Total changes: - 3

Description

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier), 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier), APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 and earlier), APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier), APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 and earlier), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G), InRow Cooling for series ACRC10x SKUs (RC10X2G), InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G), InRow Cooling Display for series ACRD3xx (ACRC2G), InRow Cooling for series ACSC1xx SKUs (SC2G), InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV, and LDWV (LEDX2G), Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier), Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier), and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Low
Attack complexity
Network
Attack vector
None
Availability
Low
Confidentiality
Low
Integrity
None
Privileges required
Changed
Scope
Required
User interaction
6.1
Base score
2.8
2.7
Exploitability score
Impact score
 

Verification logic

OR
AND
OR
vendor=schneider-electric AND product=network_management_card_2_firmware AND versionEndIncluding=6.9.8
OR
vendor=schneider-electric AND product=galaxy_3500 AND version=-
vendor=schneider-electric AND product=network_management_card_2 AND version=-
vendor=schneider-electric AND product=single-phase_symmetra AND version=-
vendor=schneider-electric AND product=smart-ups AND version=-
AND
OR
vendor=schneider-electric AND product=network_management_card_2_firmware AND versionEndIncluding=6.9.6
OR
vendor=schneider-electric AND product=ap9922_battery_management_system AND version=-
vendor=schneider-electric AND product=apc_rack_power_distribution_units AND version=-
vendor=schneider-electric AND product=galaxy_g7x AND version=-
vendor=schneider-electric AND product=galaxy_g9kchu AND version=-
vendor=schneider-electric AND product=galaxy_gcxsa AND version=-
vendor=schneider-electric AND product=galaxy_gfc AND version=-
vendor=schneider-electric AND product=galaxy_gvmsa AND version=-
vendor=schneider-electric AND product=galaxy_gvmts AND version=-
vendor=schneider-electric AND product=galaxy_gvxts AND version=-
vendor=schneider-electric AND product=galaxy_rpp_grppip2x84 AND version=-
vendor=schneider-electric AND product=gutor_gvx AND version=-
vendor=schneider-electric AND product=gutor_sxw AND version=-
vendor=schneider-electric AND product=netbotz_nbrk0250 AND version=-
vendor=schneider-electric AND product=network_management_card_2 AND version=-
vendor=schneider-electric AND product=pd40e5ek20-m AND version=-
vendor=schneider-electric AND product=pd40f6fk1-m AND version=-
vendor=schneider-electric AND product=pd40g6fk1-m AND version=-
vendor=schneider-electric AND product=pd40h5ek20-m AND version=-
vendor=schneider-electric AND product=pd40l6fk1-m AND version=-
vendor=schneider-electric AND product=pd60f6fk1 AND version=-
vendor=schneider-electric AND product=pd60g6fk1 AND version=-
vendor=schneider-electric AND product=pd60l6fk1 AND version=-
vendor=schneider-electric AND product=pdpb150g6f AND version=-
vendor=schneider-electric AND product=pdpm138h-5u AND version=-
vendor=schneider-electric AND product=pdpm138h-r AND version=-
vendor=schneider-electric AND product=pdpm144f AND version=-
vendor=schneider-electric AND product=pdpm150g6f AND version=-
vendor=schneider-electric AND product=pdpm150l6f AND version=-
vendor=schneider-electric AND product=pdpm175g6h AND version=-
vendor=schneider-electric AND product=pdpm277h AND version=-
vendor=schneider-electric AND product=pdpm288g6h AND version=-
vendor=schneider-electric AND product=pdpm72f-5u AND version=-
vendor=schneider-electric AND product=pdrppnx10 AND version=-
vendor=schneider-electric AND product=pdrppnx10m AND version=-
vendor=schneider-electric AND product=pmm400-ala AND version=-
vendor=schneider-electric AND product=pmm400-alax AND version=-
vendor=schneider-electric AND product=pmm400-cub AND version=-
vendor=schneider-electric AND product=pmm500-ala AND version=-
vendor=schneider-electric AND product=pmm500-alax AND version=-
vendor=schneider-electric AND product=pmm500-cub AND version=-
vendor=schneider-electric AND product=rack_automatic_transfer_switches AND version=-
vendor=schneider-electric AND product=symmetra_px_100 AND version=-
vendor=schneider-electric AND product=symmetra_px_160 AND version=-
vendor=schneider-electric AND product=symmetra_px_20 AND version=-
vendor=schneider-electric AND product=symmetra_px_250 AND version=-
vendor=schneider-electric AND product=symmetra_px_40 AND version=-
vendor=schneider-electric AND product=symmetra_px_48 AND version=-
vendor=schneider-electric AND product=symmetra_px_500 AND version=-
vendor=schneider-electric AND product=symmetra_px_96 AND version=-
AND
OR
vendor=schneider-electric AND product=network_management_card_3_firmware AND versionEndIncluding=1.4.2.1
OR
vendor=schneider-electric AND product=galaxy_3500 AND version=-
vendor=schneider-electric AND product=network_management_card_3 AND version=-
vendor=schneider-electric AND product=single-phase_symmetra AND version=-
vendor=schneider-electric AND product=smart-ups AND version=-
AND
OR
vendor=schneider-electric AND product=network_management_card_3_firmware AND versionEndIncluding=1.4.0
OR
vendor=schneider-electric AND product=apc_rack_power_distribution_units AND version=-
vendor=schneider-electric AND product=network_management_card_3 AND version=-
 

Reference

 


Keywords

NVD

 

CVE-2021-22813

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.