Vulnerability Details CVE-2021-22825
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated privileges when a privileged account clicks on a malicious URL that compromises the security token. Affected Products: AP7xxxx and AP8xxx with NMC2 (V6.9.6 or earlier), AP7xxx and AP8xxx with NMC3 (V1.1.0.3 or earlier), and APDU9xxx with NMC3 (V1.0.0.28 or earlier)
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 58.6%
CVSS Severity
CVSS v3 Score 8.0
CVSS v2 Score 6.0
References
Products affected by CVE-2021-22825
-
cpe:2.3:h:schneider-electric:rack_power_distribution_unit_with_network_management_card_2:-
-
cpe:2.3:h:schneider-electric:rack_power_distribution_unit_with_network_management_card_3:-
-
Schneider-Electric » Rack Power Distribution Unit With Network Management Card 2 Firmware » Version: N/Acpe:2.3:o:schneider-electric:rack_power_distribution_unit_with_network_management_card_2_firmware:-
-
Schneider-Electric » Rack Power Distribution Unit With Network Management Card 2 Firmware » Version: 6.9.6cpe:2.3:o:schneider-electric:rack_power_distribution_unit_with_network_management_card_2_firmware:6.9.6
-
Schneider-Electric » Rack Power Distribution Unit With Network Management Card 3 Firmware » Version: N/Acpe:2.3:o:schneider-electric:rack_power_distribution_unit_with_network_management_card_3_firmware:-
-
Schneider-Electric » Rack Power Distribution Unit With Network Management Card 3 Firmware » Version: 1.0.0.28cpe:2.3:o:schneider-electric:rack_power_distribution_unit_with_network_management_card_3_firmware:1.0.0.28
-
Schneider-Electric » Rack Power Distribution Unit With Network Management Card 3 Firmware » Version: 1.1.0.3cpe:2.3:o:schneider-electric:rack_power_distribution_unit_with_network_management_card_3_firmware:1.1.0.3