Information Exposure Vulnerability in Schneider Electric UPS and Power Distribution Products

CVE-2021-22815

Summary

An information exposure vulnerability allows unauthorized access to sensitive troubleshooting archives in various Schneider Electric Uninterruptible Power Supply (UPS) products and associated Network Management Card systems. This flaw primarily affects multiple models of Smart-UPS, Symmetra, Galaxy, and APC Power Distribution Units using NMC2 and NMC3, potentially exposing critical operational data. Users may inadvertently disclose sensitive information due to misconfigured access controls, which could be exploited by attackers to gain deeper insight into system configurations and operations. Proper security practices and updates are essential to mitigate risks associated with this vulnerability.

References