CVE-2021-22810

CVSS V2 Medium 4.3 CVSS V3 Medium 6.1
Description
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to a delete policy file. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier), 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier), APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 and earlier), APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier), APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 and earlier), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G), InRow Cooling for series ACRC10x SKUs (RC10X2G), InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G), InRow Cooling Display for series ACRD3xx (ACRC2G), InRow Cooling for series ACSC1xx SKUs (SC2G), InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV, and LDWV (LEDX2G), Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier), Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier), and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)
Overview
  • CVE ID
  • CVE-2021-22810
  • Assigner
  • cybersecurity@se.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-01-28T20:15:09
  • Last Modified Date
  • 2022-02-04T15:10:54
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:schneider-electric:network_management_card_2_firmware:*:*:*:*:*:*:*:* 1 OR 6.9.8
cpe:2.3:h:schneider-electric:galaxy_3500:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:network_management_card_2:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:single-phase_symmetra:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:smart-ups:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:schneider-electric:network_management_card_2_firmware:*:*:*:*:*:*:*:* 1 OR 6.9.6
cpe:2.3:h:schneider-electric:ap9922_battery_management_system:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:apc_rack_power_distribution_units:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:galaxy_g7x:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:galaxy_g9kchu:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:galaxy_gcxsa:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:galaxy_gfc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:galaxy_gvmsa:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:galaxy_gvmts:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:galaxy_gvxts:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:galaxy_rpp_grppip2x84:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:gutor_gvx:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:gutor_sxw:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:netbotz_nbrk0250:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:network_management_card_2:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pd40e5ek20-m:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pd40f6fk1-m:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pd40g6fk1-m:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pd40h5ek20-m:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pd40l6fk1-m:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pd60f6fk1:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pd60g6fk1:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pd60l6fk1:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpb150g6f:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm138h-5u:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm138h-r:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm144f:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm150g6f:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm150l6f:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm175g6h:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm277h:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm288g6h:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdpm72f-5u:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdrppnx10:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pdrppnx10m:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pmm400-ala:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pmm400-alax:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pmm400-cub:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pmm500-ala:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pmm500-alax:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:pmm500-cub:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:rack_automatic_transfer_switches:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:symmetra_px_100:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:symmetra_px_160:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:symmetra_px_20:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:symmetra_px_250:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:symmetra_px_40:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:symmetra_px_48:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:symmetra_px_500:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:symmetra_px_96:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:schneider-electric:network_management_card_3_firmware:*:*:*:*:*:*:*:* 1 OR 1.4.2.1
cpe:2.3:h:schneider-electric:galaxy_3500:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:network_management_card_3:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:single-phase_symmetra:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:smart-ups:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:schneider-electric:network_management_card_3_firmware:*:*:*:*:*:*:*:* 1 OR 1.4.0
cpe:2.3:h:schneider-electric:apc_rack_power_distribution_units:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:schneider-electric:network_management_card_3:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • REQUIRED
  • Scope
  • CHANGED
  • Confidentiality Impact
  • LOW
  • Availability Impact
  • NONE
  • Base Score
  • 6.1
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 2.8
  • Impact Score
  • 2.7
References
Reference URL Reference Tags
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03 Mitigation Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2021-22810
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22810
History
Created Old Value New Value Data Type Notes
2022-05-10 06:34:18 Added to TrackCVE
2022-12-06 07:58:50 cybersecurity@schneider-electric.com cybersecurity@se.com CVE Assigner updated
2022-12-06 07:58:50 2022-01-28T20:15Z 2022-01-28T20:15:09 CVE Published Date updated
2022-12-06 07:58:50 2022-02-04T15:10:54 CVE Modified Date updated
2022-12-06 07:58:50 Analyzed Vulnerability Status updated