medium
6.1
CWE
79
Advisory Published
Updated

CVE-2021-22813: XSS

First published: Fri Jan 28 2022(Updated: )

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier), 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier), APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 and earlier), APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier), APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 and earlier), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G), InRow Cooling for series ACRC10x SKUs (RC10X2G), InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G), InRow Cooling Display for series ACRD3xx (ACRC2G), InRow Cooling for series ACSC1xx SKUs (SC2G), InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV, and LDWV (LEDX2G), Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier), Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier), and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)

Credit: cybersecurity@se.com

Affected SoftwareAffected VersionHow to fix
Schneider Electric Network Management Card 2 Firmware<=6.9.8
Schneider Electric Galaxy 3500
Schneider Electric Network Management Card 2
Schneider Electric Symmetra
Schneider Electric Smart-UPS
Schneider Electric Network Management Card 2 Firmware<=6.9.6
Schneider Electric AP9922 Battery Management System
Schneider Electric APC Rack Power Distribution Units
Schneider Electric Galaxy G7x
Schneider Electric Galaxy G9KCHU
Schneider Electric Galaxy GCXSA
Schneider Electric Galaxy GFC
Schneider Electric Galaxy Gvmsa
Schneider Electric Galaxy GVMTS
Schneider Electric Galaxy Gvxts
Galaxy RPP GRPPI2X84
Schneider Electric Gutor GVX
Schneider Electric Gutor SXW
Schneider Electric NetBotz NBRK0250
Schneider Electric Pd40e5ek20-m
Schneider-electric PD40F6FK1-M
Schneider Electric PD40 G6FK1-M
Schneider Electric Pd40e5ek20-m
Schneider Electric PD40 G6FK1-M
Schneider Electric PD60F6FK1
Schneider Electric PD60G6FK1
Schneider Electric PD60L6FK1
Schneider Electric PDPB150G6F
Schneider Electric PDPM138H-R
Schneider Electric PDPM138H-R
Schneider Electric PDPM144F
Schneider Electric PDPM150G6F
Schneider Electric PDPM150L6F
Schneider Electric PDPM175G6H
Schneider Electric PDPM277H
Schneider-electric Pdpm288g6h
Schneider Electric PDPM72F-5U
Schneider Electric PDRPPNX10
Schneider Electric PDRPPNX10M
Schneider Electric PMM400-ALA
Schneider Electric PMM400-ALAX
Schneider Electric PMM400 CUB
Schneider Electric PMM500-ALA
Schneider Electric PMM500-ALAX
Schneider Electric PMM500-CUB
Schneider Electric Rack Automatic Transfer Switches
Schneider Electric Symmetra PX 100
Schneider Electric Symmetra
Schneider Electric Symmetra
Schneider Electric Symmetra
Schneider Electric Symmetra PX 40
Schneider Electric Symmetra PX 48
Schneider Electric Symmetra
Schneider Electric Symmetra
Schneider-electric Rack Power Distribution Unit With Network Management Card 3 Firmware<=1.4.2.1
Schneider Electric Network Management Card 3
Schneider-electric Rack Power Distribution Unit With Network Management Card 3 Firmware<=1.4.0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2021-22813?

    CVE-2021-22813 has a medium severity rating due to its potential for allowing arbitrary script execution via cross-site scripting.

  • How do I fix CVE-2021-22813?

    To fix CVE-2021-22813, update the affected Schneider Electric Network Management Card 2 Firmware to version 6.9.9 or later.

  • Which products are affected by CVE-2021-22813?

    CVE-2021-22813 affects Schneider Electric Network Management Card 2 Firmware versions up to 6.9.8.

  • What type of vulnerability is CVE-2021-22813?

    CVE-2021-22813 is classified as a Cross-site Scripting (XSS) vulnerability.

  • Who is impacted by CVE-2021-22813?

    Privileged account users of the affected Schneider Electric products are at risk when interacting with specially crafted malicious URLs.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203