Information disclosure in Schneider-Electric Rack Power Distribution Unit With Network Management Card 2
CVE-2021-22825
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated privileges when a privileged account clicks on a malicious URL that compromises the security token. Affected Products: AP7xxxx and AP8xxx with NMC2 (V6.9.6 or earlier), AP7xxx and AP8xxx with NMC3 (V1.1.0.3 or earlier), and APDU9xxx with NMC3 (V1.0.0.28 or earlier)
Vulnerability class: Information Disclosure
EPSS: 0.008 (52.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Schneider-electric Rack_power_distribution_unit_with_network_management_card_2
- Schneider-electric Rack_power_distribution_unit_with_network_management_card_2_firmware
- Schneider-electric Rack_power_distribution_unit_with_network_management_card_3
- Schneider-electric Rack_power_distribution_unit_with_network_management_card_3_firmware
- N/a — versions n/a
Weakness classification (CWE)
References
- cybersecurity@se.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-22825?
- CVE-2021-22825 is a high-severity vulnerability in Schneider-Electric Rack Power Distribution Unit With Network Management Card 2, classified under Information Disclosure. CVSS score: 8.0/10. Published 2022-01-28.
- How severe is CVE-2021-22825?
- High severity. CVSS v3 base score is 8.0 out of 10.