Description

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier), 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier), APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 and earlier), APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier), APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 and earlier), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G), InRow Cooling for series ACRC10x SKUs (RC10X2G), InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G), InRow Cooling Display for series ACRD3xx (ACRC2G), InRow Cooling for series ACSC1xx SKUs (SC2G), InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV, and LDWV (LEDX2G), Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier), Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier), and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  6.1 MEDIUM

Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score:  4.3 MEDIUM

Vector:  (AV:N/AC:M/Au:N/C:N/I:P/A:N)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03	Mitigation  Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

3 change records found show changes

CVE Modified by Schneider Electric SE 5/14/2024 4:17:40 AM

Action	Type	Old Value	New Value

Initial Analysis by NIST 2/04/2022 11:22:31 AM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 3523 characters. View Entire Change Record AND OR *cpe:2.3:o:schneider-electric:network_management_card_2_firmware:*:*:*:*:*:*:*:* versions up to (including) 6.9.6 OR cpe:2.3:h:schneider-electric:ap9922_battery_management_system:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:apc_rack_power_distribution_units:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:galaxy_g7x:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:galaxy_g9kchu:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:galax
Added	CPE Configuration		AND OR *cpe:2.3:o:schneider-electric:network_management_card_2_firmware:*:*:*:*:*:*:*:* versions up to (including) 6.9.8 OR cpe:2.3:h:schneider-electric:galaxy_3500:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:network_management_card_2:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:single-phase_symmetra:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:smart-ups:-:*:*:*:*:*:*:*
Added	CPE Configuration		AND OR *cpe:2.3:o:schneider-electric:network_management_card_3_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.4.0 OR cpe:2.3:h:schneider-electric:apc_rack_power_distribution_units:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:network_management_card_3:-:*:*:*:*:*:*:*
Added	CPE Configuration		AND OR *cpe:2.3:o:schneider-electric:network_management_card_3_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.4.2.1 OR cpe:2.3:h:schneider-electric:galaxy_3500:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:network_management_card_3:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:single-phase_symmetra:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:smart-ups:-:*:*:*:*:*:*:*
Added	CVSS V2		NIST (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Added	CVSS V2 Metadata		Victim must voluntarily interact with attack mechanism
Added	CVSS V3.1		NIST AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Added	CWE		NIST CWE-79
Changed	Reference Type	https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03 No Types Assigned	https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03 Mitigation, Vendor Advisory

CVE Modified by Schneider Electric SE 1/28/2022 4:15:08 PM

Action	Type	Old Value	New Value
Removed	CWE	Schneider Electric SE CWE-79