QID 590841

Date Published: 2022-06-03

QID 590841: APC by Schneider Electric Network Management Cards (NMC) and NMC Embedded Devices Multiple Vulnerabilities (FA410359) (SEVD-2020-174-01)

AFFECTED PRODUCTS
NMC2 for UPS models including Smart-UPS,1-Phase Symmetra,and Galaxy 3500 with NMC2:AP9630/AP9630CH/AP9630J,AP9631/AP9631CH/AP9631J,AP9635/AP9635CH NMC2 AOS V6.9.4 and prior
NMC2 for Symmetra PX 48/96/100/160 kW UPS: AP9630/AP9630CH/AP9630J,AP9631/AP9631CH/AP9631J,AP9635/AP9635CH NMC2 AOS V6.9.4 and prior
NMC2 for Symmetra PX 20/40 kW UPS:AP9630/AP9630CH/AP9630J,AP9631/AP9631CH/AP9631J,AP9635/AP9635CH NMC2 AOS V6.9.4 and prior
NMC3 Smart-UPS SmartSlot card models:AP9640/AP9640J,AP9641/AP9641J NMC3 AOS V1.3.3.1 and earlier
UPS using NMC1 -SUMX:AP9617,AP9619,AP9618,Smart-UPS models embedded with NMC1 Smart-UPS NMC1 v3.9.2 and earlier
NMC2 for InfraStruxure 150 kVA PDU with 84 Poles
PDPB150G6F NMC2 AOS v6.9.4 and earlier
NMC2 for InfraStruxure 40/60kVA PDU
PD40G6FK1-M,PD40F6FK1-M,PD40L6FK1-M,PDRPPNX10M,PD60G6FK1,PD60F6FK1,PD60L6FK1,PDRPPNX10,PD40E5EK20-M,PD40H5EK20-M NMC2 AOS v6.9.4 and earlier
NMC2 for Modular 150/175kVA PDU
PDPM150G6F, PDPM150L6F, PDPM175G6H NMC2 AOS v6.9.4 and earlier
NMC2 for 400 and 500 kVA PMM
PMM400-ALA,PMM400-ALAX,PMM400-CUB,PMM500-ALA,PMM500-ALAX,PMM500-CUB NMC2 AOS v6.9.4 and earlier
NMC2 for Modular PDU/RPP
PDPM72F-5U,PDPM138H-5U,PDPM144F,PDPM138H-R,PDPM277H,PDPM288G6H NMC2 AOS v6.9.4 and earlier
APC Rack PDU
Embedded NMC2
2G Metered/Switched Rack PDUs with embedded NMC2:AP84XX,AP86XX,AP88XX,AP89XX NMC2 AOS v6.9.4 and earlier
Embedded NMC1
Metered/Switched Rack PDU with embedded NMC1:AP78xx,AP79xx NMC1 AOS v3.9.2 and earlier
Embedded NMC2
Rack Automatic Transfer Switches-AP44XX V6.9.4 and earlier
Embedded NMC1
Rack Automatic Transfer Switches-AP77xx 3.9.2 and earlier
and several others.

QID Detection Logic (Authenticated):
QID checks for the Vulnerable version of affected product using passive scanning.

Successful exploitation of this vulnerability could cause a denial-of-service condition,Remote Code execution via a single invalid DNS response and Out-of-bounds Read.

CVSS V3 rated as Critical - 10 severity.

CVSS V2 rated as Critical - 9.3 severity.

Solution

Customers are advised to refer to CERT MITIGATIONS section FA410359 for affected packages and patching details.

Vendor References

FA410359 - www.apc.com/us/en/faqs/FA410359/

CVEs related to QID 590841

CVE-2020-11896 | CVE-2020-11898 | CVE-2020-11899 | CVE-2020-11901 | CVE-2020-11902 | CVE-2020-11904 | CVE-2020-11905 | CVE-2020-11906 | CVE-2020-11907 | CVE-2020-11909 | CVE-2020-11910 | CVE-2020-11911 | CVE-2020-11912 | CVE-2020-11913 | CVE-2020-11914 |

Software Advisories

Advisory ID	Software	Component	Link
FA410359			www.apc.com/us/en/faqs/FA410359/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].