{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier), 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier), APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 and earlier), APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier), APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 and earlier), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G), InRow Cooling for series ACRC10x SKUs (RC10X2G), InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G), InRow Cooling Display for series ACRD3xx (ACRC2G), InRow Cooling for series ACSC1xx SKUs (SC2G), InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV, and LDWV (LEDX2G), Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier), Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier), and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-01-28T19:09:47", "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@schneider-electric.com", "ID": "CVE-2021-22813", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier), 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier), APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 and earlier), APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier), APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 and earlier), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G), InRow Cooling for series ACRC10x SKUs (RC10X2G), InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G), InRow Cooling Display for series ACRD3xx (ACRC2G), InRow Cooling for series ACSC1xx SKUs (SC2G), InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV, and LDWV (LEDX2G), Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier), Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier), and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03", "refsource": "MISC", "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:51:07.536Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03"}]}]}, "cveMetadata": {"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "cveId": "CVE-2021-22813", "datePublished": "2022-01-28T19:09:47", "dateReserved": "2021-01-06T00:00:00", "dateUpdated": "2024-08-03T18:51:07.536Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:network_management_card_2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B680F42-DA8E-4802-B156-8AB5DAE7FBBE", "versionEndIncluding": "6.9.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:galaxy_3500:-:*:*:*:*:*:*:*", "matchCriteriaId": "9CB0BD90-277B-4214-A0D2-0CFE156F3747", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:network_management_card_2:-:*:*:*:*:*:*:*", "matchCriteriaId": "8D955CFE-4142-4ED1-9C66-DF97421BF491", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:single-phase_symmetra:-:*:*:*:*:*:*:*", "matchCriteriaId": "B11F1E08-643E-4DAC-8D41-4D620F27919D", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:smart-ups:-:*:*:*:*:*:*:*", "matchCriteriaId": "1355F2F4-72EF-4643-82DC-5F35FAA643EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:network_management_card_2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "39AB64C8-1BA8-45E7-BDD0-D9280C05178B", "versionEndIncluding": "6.9.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:ap9922_battery_management_system:-:*:*:*:*:*:*:*", "matchCriteriaId": "D5658510-1BDD-4AFE-946D-36FFAD91F15B", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:apc_rack_power_distribution_units:-:*:*:*:*:*:*:*", "matchCriteriaId": "48B862C7-A8BD-4FF4-BBFE-70137B197471", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:galaxy_g7x:-:*:*:*:*:*:*:*", "matchCriteriaId": "D367AAD0-542D-4D79-B346-759617A9F647", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:galaxy_g9kchu:-:*:*:*:*:*:*:*", "matchCriteriaId": "E51763D6-14F4-4F83-8391-A5ECBC17B2D5", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:galaxy_gcxsa:-:*:*:*:*:*:*:*", "matchCriteriaId": "F9A1A88B-3B10-475C-AB0E-BD450F01B64C", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:galaxy_gfc:-:*:*:*:*:*:*:*", "matchCriteriaId": "6A624A78-0441-443A-8E78-A2A554773BCB", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:galaxy_gvmsa:-:*:*:*:*:*:*:*", "matchCriteriaId": "72CFF0A0-C4DA-44A5-8F55-ACD7041A14C5", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:galaxy_gvmts:-:*:*:*:*:*:*:*", "matchCriteriaId": "26D837D0-11FD-404F-A0CB-70908DC44D80", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:galaxy_gvxts:-:*:*:*:*:*:*:*", "matchCriteriaId": "DA8C2098-FF34-482B-AC83-8C94D244A890", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:galaxy_rpp_grppip2x84:-:*:*:*:*:*:*:*", "matchCriteriaId": "8FB59B97-7253-429B-A637-051B86759F7C", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gutor_gvx:-:*:*:*:*:*:*:*", "matchCriteriaId": "21051ECC-603F-4B1D-87E3-898418646133", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:gutor_sxw:-:*:*:*:*:*:*:*", "matchCriteriaId": "98191379-455C-48E9-A37F-56255EEE9EEF", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:netbotz_nbrk0250:-:*:*:*:*:*:*:*", "matchCriteriaId": "C101890D-06AC-44DF-8AF5-FCAD321B3600", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:network_management_card_2:-:*:*:*:*:*:*:*", "matchCriteriaId": "8D955CFE-4142-4ED1-9C66-DF97421BF491", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pd40e5ek20-m:-:*:*:*:*:*:*:*", "matchCriteriaId": "591B287E-8957-456E-82B3-549D069B6CE2", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pd40f6fk1-m:-:*:*:*:*:*:*:*", "matchCriteriaId": "0C20B242-175B-49C8-9662-47C9A7AE144F", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pd40g6fk1-m:-:*:*:*:*:*:*:*", "matchCriteriaId": "62A7198F-6652-4E3D-A601-C24C8FACEAE7", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pd40h5ek20-m:-:*:*:*:*:*:*:*", "matchCriteriaId": "40D386FD-741F-45C1-989B-DBF9335945E9", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pd40l6fk1-m:-:*:*:*:*:*:*:*", "matchCriteriaId": "8543ECA3-6AFB-4B08-9334-0272646F8DB8", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pd60f6fk1:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E315DD1-C867-4D48-B898-56E3DA304206", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pd60g6fk1:-:*:*:*:*:*:*:*", "matchCriteriaId": "7ED5EF3C-0CBF-41E1-A72A-E58C3AB8B90D", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pd60l6fk1:-:*:*:*:*:*:*:*", "matchCriteriaId": "E1CC024F-31B2-4343-8AE4-400D6C3F53FD", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpb150g6f:-:*:*:*:*:*:*:*", "matchCriteriaId": "CF4D8F03-27DD-4366-A89B-22CBD7C67D7A", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm138h-5u:-:*:*:*:*:*:*:*", "matchCriteriaId": "D3C628B3-0E90-4E4C-8801-9FAA95FBD0F8", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm138h-r:-:*:*:*:*:*:*:*", "matchCriteriaId": "16C3F7D6-6700-4D2E-A1BA-888B7E16D9A0", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm144f:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0383E54-C675-4A3A-B100-D9C5AF03738C", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm150g6f:-:*:*:*:*:*:*:*", "matchCriteriaId": "E080E19A-A326-4F44-A822-C94535239BFA", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm150l6f:-:*:*:*:*:*:*:*", "matchCriteriaId": "AE8584C8-31DD-49E4-8335-CEEB5FA5ECF5", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm175g6h:-:*:*:*:*:*:*:*", "matchCriteriaId": "D8681C6E-B21D-44F0-895E-CAED4F6989A7", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm277h:-:*:*:*:*:*:*:*", "matchCriteriaId": "21974FF3-9F0C-4B9C-AD84-5D97FC72BA42", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm288g6h:-:*:*:*:*:*:*:*", "matchCriteriaId": "9F22D1C0-7024-4D70-8CD6-322613C36045", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdpm72f-5u:-:*:*:*:*:*:*:*", "matchCriteriaId": "88134542-3217-469F-9958-3CE0BC9157F7", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdrppnx10:-:*:*:*:*:*:*:*", "matchCriteriaId": "5E2885AF-A708-47FF-B9F4-DA59B170A3F0", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pdrppnx10m:-:*:*:*:*:*:*:*", "matchCriteriaId": "5A12242E-85FB-4079-90F9-B9DD61562753", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pmm400-ala:-:*:*:*:*:*:*:*", "matchCriteriaId": "74A567E2-E660-4647-862A-4411B44BC1E8", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pmm400-alax:-:*:*:*:*:*:*:*", "matchCriteriaId": "F2397DC2-AEF6-4801-99F7-671908F1121B", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pmm400-cub:-:*:*:*:*:*:*:*", "matchCriteriaId": "F058F380-9F1C-469A-BE4D-CFE94A325937", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pmm500-ala:-:*:*:*:*:*:*:*", "matchCriteriaId": "08F98F3F-A700-4D3D-832A-0866BC406C99", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pmm500-alax:-:*:*:*:*:*:*:*", "matchCriteriaId": "D301B3D0-7DA7-4433-85F8-D0F6B0B2CB00", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:pmm500-cub:-:*:*:*:*:*:*:*", "matchCriteriaId": "E6FDCF96-81B4-4E9D-842A-60BAF8FBD63E", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:rack_automatic_transfer_switches:-:*:*:*:*:*:*:*", "matchCriteriaId": "233D8B17-03A3-4E57-A96B-1A0FEC55E711", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:symmetra_px_100:-:*:*:*:*:*:*:*", "matchCriteriaId": "2F1F6A74-A959-4729-80A0-B4A8976271CF", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:symmetra_px_160:-:*:*:*:*:*:*:*", "matchCriteriaId": "D5FACD9F-9ECC-4AD4-B88A-DAB0C80DD746", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:symmetra_px_20:-:*:*:*:*:*:*:*", "matchCriteriaId": "454AAEB3-2752-41BD-A3F6-78515D3D30E2", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:symmetra_px_250:-:*:*:*:*:*:*:*", "matchCriteriaId": "414089E6-4ECB-451B-8319-9BE9BFD1FCDA", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:symmetra_px_40:-:*:*:*:*:*:*:*", "matchCriteriaId": "0264FD0E-57AF-46AF-8135-1EE8782B4854", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:symmetra_px_48:-:*:*:*:*:*:*:*", "matchCriteriaId": "5D30C4D7-16D5-4426-8EB7-25F89F0417DD", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:symmetra_px_500:-:*:*:*:*:*:*:*", "matchCriteriaId": "F6837B93-F653-49BC-A931-4FC8E800BFB2", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:symmetra_px_96:-:*:*:*:*:*:*:*", "matchCriteriaId": "4C9AA6F1-7C6C-4A5B-85D4-31995EBF2567", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:network_management_card_3_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BC92355-63D8-4472-84B6-6A012B1264D7", "versionEndIncluding": "1.4.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:galaxy_3500:-:*:*:*:*:*:*:*", "matchCriteriaId": "9CB0BD90-277B-4214-A0D2-0CFE156F3747", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:network_management_card_3:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7D86A9F-1FAB-4355-B1D9-D43EA23575D4", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:single-phase_symmetra:-:*:*:*:*:*:*:*", "matchCriteriaId": "B11F1E08-643E-4DAC-8D41-4D620F27919D", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:smart-ups:-:*:*:*:*:*:*:*", "matchCriteriaId": "1355F2F4-72EF-4643-82DC-5F35FAA643EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:network_management_card_3_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F9C697A-21D3-4E53-9905-CF122EBA410A", "versionEndIncluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:apc_rack_power_distribution_units:-:*:*:*:*:*:*:*", "matchCriteriaId": "48B862C7-A8BD-4FF4-BBFE-70137B197471", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:network_management_card_3:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7D86A9F-1FAB-4355-B1D9-D43EA23575D4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier), 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier), APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 and earlier), APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier), APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 and earlier), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G), InRow Cooling for series ACRC10x SKUs (RC10X2G), InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G), InRow Cooling Display for series ACRD3xx (ACRC2G), InRow Cooling for series ACSC1xx SKUs (SC2G), InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV, and LDWV (LEDX2G), Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier), Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier), and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)"}, {"lang": "es", "value": "Una CWE-79: Se presenta una vulnerabilidad de Neutralizaci\u00f3n Inapropiada de la Entrada Durante la Generaci\u00f3n de la P\u00e1gina Web (\"Cross-site Scripting\") que podr\u00eda causar una ejecuci\u00f3n de un script arbitrario cuando una cuenta con privilegios hace clic en una URL maliciosa espec\u00edficamente dise\u00f1ada para el NMC que apunta a un archivo de pol\u00edtica de edici\u00f3n. Productos afectados: Sistemas de alimentaci\u00f3n ininterrumpida (SAI) monof\u00e1sicos que usan NMC2, incluidos Smart-UPS, Symmetra y Galaxy 3500 con Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 y anteriores), Sistema de Alimentaci\u00f3n Ininterrumpida (SAI) trif\u00e1sico usando NMC2 incluyendo Symmetra PX 250/500 (SYPX) Tarjeta de administraci\u00f3n de Red 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 y anteriores), sistemas de alimentaci\u00f3n ininterrumpida (SAI) trif\u00e1sicos que usan NMC2, incluidos los SAI Symmetra PX 48/96/100/160 kW (PX2), los SAI Symmetra PX 20/40 kW (SY3P), Gutor (SXW, GVX) y Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 y anteriores), Sistema de Alimentaci\u00f3n Ininterrumpida (SAI) monof\u00e1sico usado NMC3 incluyendo Smart-UPS, Symmetra, y Galaxy 3500 con Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 y anteriores), Unidades de distribuci\u00f3n de energ\u00eda (PDU) de rack de APC que usan NMC2 2G PDU de rack medido/conmutado con NMC2 incorporado: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 y anteriores), Unidades de distribuci\u00f3n de energ\u00eda (PDU) en rack de APC que usan PDU en rack medido/conmutado NMC3 2G con NMC3 integrado: APDU99xx (NMC3 AOS V1.4. 0 y anteriores), productos de distribuci\u00f3n de energ\u00eda trif\u00e1sica de APC que usan NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 y anteriores), tarjeta de administraci\u00f3n de red 2 (NMC2) para InfraStruxure 150 kVA PDU con 84 polos (X84P): PDPB150G6F (NMC2 AOS V6.9.6 y anteriores), Tarjeta de administraci\u00f3n de Red 2 para InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 y anteriores), Tarjeta de administraci\u00f3n de Red 2 para PDU Modular 150/175kVA (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 y anteriores), Tarjeta de administraci\u00f3n de red 2 para 400 y 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 y anteriores), Tarjeta de administraci\u00f3n de Red 2 para PDU Modular (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 y anteriores), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Interruptores de transferencia autom\u00e1tica en rack - AP44XX (ATS4G) (NMC2 AOS V6.9.6 y anteriores), Tarjeta de administraci\u00f3n de red 2 (NMC2) Productos de refrigeraci\u00f3n: InRow Cooling para las series ACRP5xx, ACRP1xx, ACRD5xx y ACRC5xx SKU (ACRP2G), InRow Cooling para las series ACRC10x SKU (RC10X2G), InRow Cooling para las series ACRD6xx y ACRC6xx SKU (ACRD2G), InRow Cooling Display para las series ACRD3xx (ACRC2G), InRow Cooling para las series ACSC1xx SKUs (SC2G), InRow Cooling para las series ACRD1xx y ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display para SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV y LDWV (LEDX2G), Unidad de distribuci\u00f3n de refrigerante: ACDA9xx (RDU) (NMC2 AOS V6.9.6 y anteriores), Unidad de Monitorizaci\u00f3n Ambiental con NMC2 integrado (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 y anteriores), y Tarjeta de administraci\u00f3n de Red 2 (NMC2): AP9922 Sistema de administraci\u00f3n de la bater\u00eda (BM4) (NMC2 AOS V6.9.6 y anteriores)"}], "id": "CVE-2021-22813", "lastModified": "2024-11-21T05:50:43.330", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-01-28T20:15:10.147", "references": [{"source": "cybersecurity@se.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}