Cross-site Scripting Vulnerability in Schneider Electric UPS Products
CVE-2021-22811

6.1MEDIUM

Key Information:

Vendor
Schneider Electric
Status
Network Management Card 2 Firmware
Vendor
CVE Published:
28 January 2022

Summary

A vulnerability exists in Schneider Electric's UPS products that allows unauthorized script execution due to improper input validation. This security flaw occurs when a request made by a privileged account is intercepted while accessing a vulnerable web page. Attackers can exploit this issue to execute arbitrary scripts in the context of the user's session, potentially compromising sensitive information and system integrity. Affected versions operate under Network Management Card (NMC2 and NMC3) AOS specifications revealing the critical need for updates and patches to safeguard against exploitation.

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.