CVE-2021-22814 Information

Description

A CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists which could cause arbritrary script execution when a malicious file is read and displayed. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS Symmetra and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J AP9631/AP9631CH/AP9631J AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier) 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J AP9631/AP9631CH/AP9631J AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier) 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2) Symmetra PX 20/40 kW UPS (SY3P) Gutor (SXW GVX) and Galaxy (GVMTS GVMSA GVXTS GVXSA G7K GFC G9KCHU): AP9630/AP9630CH/AP9630J AP9631/AP9631CH/AP9631J AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier) 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS Symmetra and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J AP9641/AP9641J AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier) APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX AP86XX AP88XX AP89XX (NMC2 AOS V6.9.6 and earlier) APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier) APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier) Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier) Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M PD40F6FK1-M PD40L6FK1-M PDRPPNX10 MPD60G6FK1 PD60F6FK1 PD60L6FK1 PDRPPNX10 PD40E5EK20-M PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier) Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F PDPM150L6F PDPM175G6H (NMC2 AOS V6.9.6 and earlier) Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA PMM400-ALAX PMM400-CUB PMM500-ALA PMM500-ALAX PMM500-CUB (NMC2 AOS V6.9.6 and earlier) Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U PDPM138H-5U PDPM144F PDPM138H-R PDPM277H PDPM288G6H (NMC2 AOS V6.9.6 and earlier) Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier) Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx ACRP1xx ACRD5xx and ACRC5xx SKUs (ACRP2G) InRow Cooling for series ACRC10x SKUs (RC10X2G) InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G) InRow Cooling Display for series ACRD3xx (ACRC2G) InRow Cooling for series ACSC1xx SKUs (SC2G) InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G) Ecoflair IAEC25/50 Air Economizer Display (EB2G) Uniflair SP UCF0481I UCF0341I (UNFLRSP) Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV IDEV IDWV IUAV IUEV IUWV IXAV IXEV IXWV LDAV LDEV and LDWV (LEDX2G) Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier) Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier) and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1