PT-2022-9285 · Apc · Apc Symmetra Px 48/96/100/160 Kw Ups+19

Published 2022-01-28 · Updated 2022-10-25 · CVE-2021-22815

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions APC Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2) versions 6.9.8 and earlier APC Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2) versions 6.9.6 and earlier APC Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU) with Network Management Card 2 (NMC2) versions 6.9.6 and earlier APC Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3) versions 1.4.2.1 and earlier APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2 versions 6.9.6 and earlier APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3 versions 1.4.0 and earlier APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP versions 6.9.6 and earlier Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P) versions 6.9.6 and earlier Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) versions 6.9.6 and earlier Network Management Card 2 for Modular 150/175kVA PDU (XRDP) versions 6.9.6 and earlier Network Management Card 2 for 400 and 500 kVA (PMM) versions 6.9.6 and earlier Network Management Card 2 for Modular PDU (XRDP2G) versions 6.9.6 and earlier Rack Automatic Transfer Switches (ATS) Embedded NMC2 versions 6.9.6 and earlier Network Management Card 2 (NMC2) Cooling Products versions 6.9.6 and earlier Environmental Monitoring Unit with embedded NMC2 (NB250) versions 6.9.6 and earlier Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) versions 6.9.6 and earlier

Description A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed.

Recommendations For APC Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2) versions 6.9.8 and earlier, update to a version later than 6.9.8. For APC Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2) versions 6.9.6 and earlier, update to a version later than 6.9.6. For APC Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU) with Network Management Card 2 (NMC2) versions 6.9.6 and earlier, update to a version later than 6.9.6. For APC Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3) versions 1.4.2.1 and earlier, update to a version later than 1.4.2.1. For APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2 versions 6.9.6 and earlier, update to a version later than 6.9.6. For APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3 versions 1.4.0 and earlier, update to a version later than 1.4.0. For APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP versions 6.9.6 and earlier, update to a version later than 6.9.6. For Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P) versions 6.9.6 and earlier, update to a version later than 6.9.6. For Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) versions 6.9.6 and earlier, update to a version later than 6.9.6. For Network Management Card 2 for Modular 150/175kVA PDU (XRDP) versions 6.9.6 and earlier, update to a version later than 6.9.6. For Network Management Card 2 for 400 and 500 kVA (PMM) versions 6.9.6 and earlier, update to a version later than 6.9.6. For Network Management Card 2 for Modular PDU (XRDP2G) versions 6.9.6 and earlier, update to a version later than 6.9.6. For Rack Automatic Transfer Switches (ATS) Embedded NMC2 versions 6.9.6 and earlier, update to a version later than 6.9.6. For Network Management Card 2 (NMC2) Cooling Products versions 6.9.6 and earlier, update to a version later than 6.9.6. For Environmental Monitoring Unit with embedded NMC2 (NB250) versions 6.9.6 and earlier, update to a version later than 6.9.6. For Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) versions 6.9.6 and earlier, update to a version later than 6.9.6.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-22815

Affected Products

400/500 Kva

Ap9922 Battery Management System

Apc 3-Phase Power Distribution Products

Apc Rack Power Distribution Units

Apc Smart-Ups

Apc Symmetra Px 250/500

Apc Symmetra Px 48/96/100/160 Kw Ups

Environmental Monitoring Unit With Embedded Nmc2

Galaxy

Galaxy 3500

Gutor

Infrastruxure 150 Kva Pdu With 84 Poles

Infrastruxure 40/60Kva Pdu

Modular 150/175Kva Pdu

Modular Pdu

Network Management Card 2

Network Management Card 3

Rack Automatic Transfer Switches

Symmetra

Symmetra Px 20/40 Kw Ups

References · 4

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22815 · Security Note
• https://t.me/cibsecurity/36499 · Telegram Post